Tool to grab sensitive information from command lines Of the information entered on the command line (command name and arguments) have to be considered public (everyone can access it using commands like ps).

Is there a known tool to automate this kind of information gathering? This tool would look regularly at the process list, would parse command lines and gather information like usernames and passwords.

I am willing to run this kind of tool on my company's systems to identify bad practices, but I can't seem to find one.

On Linux systems, all of this information is available through the proc interface, and as such is fairly easily scriptable. As a working example (coming from a RHEL6 system) let's look at the rsyslog process.

[user@node1 ~]$ ps aux | grep rsyslog
root      1105  0.0  0.0 248680  1460 ?        Sl   May29   0:42 /sbin/rsyslogd -i /var/run/syslogd.pid -c 4
user     26440  0.0  0.0 103236   824 pts/4    S+   11:38   0:00 grep rsyslog

Right, so the pid is 1105, easy enough. Since the proc system stores processes in the format of /proc/<pid> let's see what data is being presented.

[user@node1 ~]$ ls -l /proc/1105
ls: cannot read symbolic link /proc/1105/cwd: Permission denied
ls: cannot read symbolic link /proc/1105/root: Permission denied
ls: cannot read symbolic link /proc/1105/exe: Permission denied
total 0
dr-xr-xr-x. 2 root root 0 Jun 15 11:39 attr
-rw-r--r--. 1 root root 0 Jun 15 11:39 autogroup
-r--------. 1 root root 0 Jun 15 11:39 auxv
-r--r--r--. 1 root root 0 Jun 15 11:39 cgroup
--w-------. 1 root root 0 Jun 15 11:39 clear_refs
-r--r--r--. 1 root root 0 Jun 15 11:35 cmdline
-rw-r--r--. 1 root root 0 Jun 15 11:39 coredump_filter
-r--r--r--. 1 root root 0 Jun 15 11:39 cpuset
lrwxrwxrwx. 1 root root 0 Jun 15 11:39 cwd
-r--------. 1 root root 0 Jun 15 11:39 environ
lrwxrwxrwx. 1 root root 0 Jun 15 11:39 exe
dr-x------. 2 root root 0 Jun 15 11:39 fd
dr-x------. 2 root root 0 Jun 15 11:39 fdinfo
-r--------. 1 root root 0 Jun 15 11:39 io
-rw-------. 1 root root 0 Jun 15 11:39 limits
-rw-r--r--. 1 root root 0 Jun 15 11:39 loginuid
-r--r--r--. 1 root root 0 Jun 15 11:39 maps
-rw-------. 1 root root 0 Jun 15 11:39 mem
-r--r--r--. 1 root root 0 Jun 15 11:39 mountinfo
-r--r--r--. 1 root root 0 Jun 15 11:39 mounts
-r--------. 1 root root 0 Jun 15 11:39 mountstats
dr-xr-xr-x. 6 root root 0 Jun 15 11:39 net
-r--r--r--. 1 root root 0 Jun 15 11:39 numa_maps
-rw-r--r--. 1 root root 0 Jun 15 11:39 oom_adj
-r--r--r--. 1 root root 0 Jun 15 11:39 oom_score
-rw-r--r--. 1 root root 0 Jun 15 11:39 oom_score_adj
-r--r--r--. 1 root root 0 Jun 15 11:39 pagemap
-r--r--r--. 1 root root 0 Jun 15 11:39 personality
lrwxrwxrwx. 1 root root 0 Jun 15 11:39 root
-rw-r--r--. 1 root root 0 Jun 15 11:39 sched
-r--r--r--. 1 root root 0 Jun 15 11:39 schedstat
-r--r--r--. 1 root root 0 Jun 15 11:39 sessionid
-r--r--r--. 1 root root 0 Jun 15 11:39 smaps
-r--r--r--. 1 root root 0 Jun 15 11:39 stack
-r--r--r--. 1 root root 0 Jun 15 11:35 stat
-r--r--r--. 1 root root 0 Jun 15 11:39 statm
-r--r--r--. 1 root root 0 Jun 15 11:35 status
-r--r--r--. 1 root root 0 Jun 15 11:39 syscall
dr-xr-xr-x. 6 root root 0 Jun 15 11:39 task
-r--r--r--. 1 root root 0 Jun 15 11:39 wchan

I'm running this as a normal user, so some of the information is unavailable. No big deal, because what we really want is that there file called cmdline.

[user@node1 ~]$ cat /proc/1105/cmdline
/sbin/rsyslogd-i/var/run/syslogd.pid-c4[user@node1 ~]$

The arguments look like they're all run together. In fact, they are separated by null characters. You'll get a more friendly display by turning the null characters into newlines (but note this will drop the distinction between separations between arguments and actual newlines in an argument):

[user@node1 ~]$ tr '\0' '\n' </proc/1105/cmdline; echo
/sbin/rsyslogd
-i
/var/run/syslogd.pid
-c
4
[user@node1 ~]$

Granted, this doesn't really give us anything beyond what we got from the ps output. However, depending on what you want it may be more easily scriptable. If we wanted to work exclusively in bash, for instance, you could use this structure to iterate over all processes:

for p in /proc/[0-9]*/cmdline; do
  …
done

Then use that as a file list for processing.

If you are instead into Perl, there exists a module called Proc::ProcessTable that queries the proc system and exposes the same information as an object.

All that being said, if you want to look for passwords on the command line, you may sometimes be disappointed. Some applications somehow work to mask it out, for example MySQL:

[user@node2 ~]$ ps aux | grep mysql
user     7974  0.0  0.1 157116  2732 pts/0    S+   11:47   0:00 mysql -u root -px xxxxxxxxxx database
[user@node2 ~]$ cat /proc/7974/cmdline
mysql-uroot-pxxxxxxxxxxxdashboard[user@node2 ~]$


Is there an equivalent of Control Flow Guard for Linux? Introduced by Microsoft in recent versions of Windows and its compilers, Control Flow Guard is a useful defence in depth measure in the mitigation of return-oriented programming exploits.

My question is, is there any equivalent of this available or planned on any other operating system and compiler - particularly Linux and GCC?

It appears to that there are two possible implementation working in Linux. One is made by grsecurity named: "Reuse attack Protector (RAP)". Another is in llvm implemented and calls control flow integrity  (cfi). As I understood: CFG is the marketing name of Microsoft for control flow integrity.

The Chrome Team seems to work with that very well.

Most of the information came from Hanno Böck's Presentation. He also provides some more details where CFI/CFG would have helped.
In addition, you might take a look at this. Just not that you get the impression that this is a silver bullet.


I'm not sure if this Website is SQL Injectable I think I found an SQL vulnerability; the request and response can be found below. I'm not sure because it is showing a normal error (it's in French) instead of showing an SQL error.
I also tried to SQL inject the user page (after I logged in normally to the site) by adding a quote (') to a parameter, but I got the same normal error instead of the SQL one.
Could someone experienced tell me if this is an SQL error message and if an exploit is possible? If yes, how can someone exploit this?
GET /Anonym/Login.aspx?lnrid=636705509463187707" UNION SELECT SLEEP(30) -- &_lnPageGuid=0709206f-a5aa-40cf-bad7-78fb5452f5df&__EGClientState=NY&__VIEWSTATE=NY&__EVENTVALIDATION=%2FwEdAAivVXD1oYELeveMr0vHCmYPbKvSQfBZG4FRSb%2F8I7pm6gbzWSkUOVnL89VotOv3iwS9OtS9D9WQklHFFt9eID42Uj1o80q1QHHhR9Njbuhhm5HMJLG0qgnnIQHDWK64dEQaUDEQ2ba3nFNQp5gIEycdbMy1%2F4YQMXKqdpE3Qw%2F6%2Fw%3D%3D&egWindowManager%24clientWindow%24Oui=Oui&egWindowManager%24clientWindow%24Non=Non&egWindowManager%24clientWindow%24Ok=Ok&ctlUserCode=vega&ctlUserPassword=vega&ctlLogon=Connexion
Host: redacted
User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:61.0) Gecko/20100101 Firefox/61.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-GB,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Cache-Control: max-age=0

HTTP/1.1 200 OK
Cache-Control: private
Content-Type: text/html; charset=utf-8
Server: Microsoft-IIS/7.5
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
X-UA-Compatible: IE=edge
Date: Fri, 24 Aug 2018 07:37:32 GMT
Content-Length: 2082

[error page; only relevant parts:]

<form name="FrmErr" method="post" action="../PageErreur.aspx?lnrid=636705509463187707%22+UNION+SELECT+SLEEP(30)+--+&amp;_lnPageGuid=0709206f-a5aa-40cf-bad7-78fb5452f5df&amp;__EGClientState=NY&amp;egWindowManager%24clientWindow%24Oui=Oui&amp;egWindowManager%24clientWindow%24Non=Non&amp;egWindowManager%24clientWindow%24Ok=Ok&amp;ctlUserCode=vega&amp;ctlUserPassword=vega&amp;ctlLogon=Connexion" id="FrmErr">

<input type="hidden" name="__VIEWSTATE" id="__VIEWSTATE" value="/wEPDwUKMTk3MzY5NzU2NmRk" />

                    &nbsp;

Le site éprouve présentement des difficultés, nous sommes désolés du contretemps.

</form>

Your error message is not really conclusive. It just states (if my french isn't as bad as I think it is) that the site encountered some kind of error. This may mean literally everything from "SQL returned an error" to "The backend's gone because a plane crashed into it".

Also you were trying to inject this:

  " UNION SELECT SLEEP(30) --

What behaviour would you expect from a vulnerable site? In case your statement is sytactically correct, most likely you would expect an errorless return of the server after 30 seconds. So: Did you measure the time?

Also: How did you conclude this is the correct syntax for whatever used backend? There are multiple different SQL-based languages and interpreters and choosing the wrong syntax will most likely produce errors independent of applied filtering.

So you questions might be answered with:

  Could someone experienced tell me if this is an SQL error message and if an exploit is possible?

No it's most likely impossible on basis of the information provided.

  If yes, how can someone exploit this?

It most likely doesn't matter. If you manage to prove that SQL-Injection is possible (bei either producing an actual SQL error or conclude from timing or error-basis), there will probably be no reason to exploit.

Just tell the owner ;)


Why would configuring a Blackberry to turn radio off when charging help with security? A friend's work Blackberry is configured so that phone and Internet access are disabled while the device is charging. I assumed this was a fault, but apparently it's a deliberate security policy.

Has anyone encountered this kind of policy before? And does anyone know what the security benefits are supposed to be?

Has anyone encountered this kind of policy before?

  And does anyone know what the security benefits are supposed to be?

The security benefit is that the devices exposure is greatly reduced with little cost in terms of availability.

In security the risk to a given asset is described by three factors: threats, vulnerabilities and exposure.

The Blackberry is exposed to a wider threat environment whenever it is remotely accessible. That is whenever the network capabilities of the device are active; a threat (person) could attempt to remotely gain unauthorized access to the device. If the network capabilities of the device are inactive then a thread (person) must be physically adjacent to the device in order to gain access. Generally users do not like to lose network access, but when the user is charging the device, they are typically not using it. Most mobile devices get charged over night when their users are sleeping.

Additionally, if a threat was to attempt to access the device remotely and the user was interacting with the device they may notice some odd behavior. If the user is not interacting with the device they would not be able to observe any anomalies due to a remote threat.


What are good ways to check for tampering/bad behaviour on a linux server that has already been set up but it's your first time logging into it For this I am assuming we have a server that is of a client or a friend, so we the helper are not innately familiar with exactly how things should be be.

What are good commands and ways to check to see if anything bad has been going on?

I know we have: the 'history' command, to see commands that have been entered and the 'last' command to see who else has been logging in.

Is there a general guide or set of best practices I can be referred to? I am using Ubuntu myself.

If you have reason to believe that the system may be compromised then wipe the server and restore from last known good backup.

By all means take an image to see if you can determine how the system was compromised and plug the vulnerability. But this is not an easy process, particularly if you have no experience at this kind of thing - indeed if you attempt this yourself then it's likely that such intervention may occlude the nature of the compromise - certainly the "evidence" would be considered severely tainted by any law enforcement / jurisdiction.

Validating the package checksums is a starting point — but not nearly as effective as a properly managed file integrity checking regime (tripwire, LIDS etc). Logs are good place to look too. But you have to understand what these tools are telling you.

There's lots of things you should be doing before a system is compromised: configuring the permissions, firewall, optionally installing additional security measures such as mod_security, suhosin, fail2ban etc. Part of the maintenance of a server should be running a rootkit detector on it regularly. For a system/cluster of significant value you should also be carrying out periodic vulnerability scanning. But there's no point in doing any of this after the event.


Can sms-only authentication be safe? many Android mobile applications (e.g., Whatsapp, Telegram), when used for the first time on a device, "authenticate" users by sending them a secret code in a SMS message.

The same mechanism is used to allow users to re-login in their accounts if they  change device or reinstall the app (as far as they are still using a SIM card with the original phone number).

I assume this mechanism is used to allow a "user-friendly" password-less authentication.

I was wondering up to which extent this mechanism can be considered "secure".

In particular, a malicious app installed on the victim's device can easily:

communicate with the app's backend asking to login into a previously created account
receive the authentication sms and read its content
use the received code to (silently) login into the victim's account

Is there any way to defend from this kind of attacks?

It is usually a mistake to think of security as either it is or it isn't. You really need to do a basic risk assessment. As a comparison, ask the question "Is my house secure?" The answer to this question is not yes or no. It really depends on factors like where your house is located i.e. 30 miles from the nearest town is possibly safer than in a suburb with a high level of crime or burglaries. for my house in the country, I might have just standard locks, but for my house in the city, I might have high quality deadbolt locks, alarms, a guard dog etc. If on the other hand, I collect valuable art work and keep it in my country house and I just use my town hose as a crash pad for when I'm in town, I might invest in alarms and dogs for my country house and not really worry about the town hose as there isn't much value there and even if someone does break in, it probably won't have much impact to me.

the other point to consider is that if someone really wants to break into my house, I probably won't be able to stop them. All I can really do is make the cost of breaking in for the thief higher than the reward/value they will obtain.

The same ideas apply with respect to the use of SMS for verification etc. There are numerous reports of people having their Google mail account hacked despite using Google's two step verification (which includes an SMS code). See for example  http://gizmodo.com/how-hackers-reportedly-side-stepped-gmails-two-factor-a-1653631338 In addition to the risk of a malicious app on your phone stealing that information (there are numerous reports of banking malware which does this), there is also the risk that someone will hack your service provider and redirect your number to their phone. This is why most of the better systems don't rely only on the SMS. Often the SMS is just one bit of information which is required to gain access.

However, just like the house example, whether it is secure really depends on evaluating the risks. For example, I use an app which records todo items, bookmarks and other notes. It uses SMS as a way to recover my account should I forget my password or whenever I access it from a new device. Is this secure? For me, it is secure enough. If someone was to redirect my phone and get my SMS code and access the site, so what? They get access to my todo list and SMS messages. Most likely, it would just be an inconvenience. However, if my bank just used an SMS code to authenticate me, I would probably switch banks because this would be a much higher risk.

So, in general, SMS on its own as a form of authentication is not great, but may be sufficient for some things and is definitely not sufficient for others. If it is only part of the authentication process and requires additional information, that is probably better, but for some applications, may be a little excessive. Essentially, you need to evaluate its use in context and be wary of sweeping statements that say it is or isn't secure.


How can NSA see everything without us noticing that? Here's one thing that keeps bugging me ever since I heard about the NSA revelations. From what I heard, NSA built a system that basically sees most of the internet, made of many subsystems which affect the networks. Judging by the leaked documents, they were pretty invasive, yet nothing was detected before. How is that possible?

I mean, I don't believe in perfect software at the first try. Especially a system that processes a tremendous lot of various data in the real time. How could they design a system that achieves that, without getting hacked or at least crashes resulting in observable anomalies?

The technology to tap an internet connection and copy all the data going over it without anyone detecting anything has existed for quite some time. There are network hardware taps, software taps, and data dumps of all types that could be happening completely undetected by those whose traffic is being sniffed. Observing the data doesn't change it in this case.

Once the NSA have the data they can then do whatever processing they want on it, as for why they haven't been hacked I'd be surprised if they'd connected their infrastructure to any public networks. Contrary to popular media most governments are very effective at keeping things secret when they want to.


Is it possible for a website to get information about you through its upload feature? Reddit has a new image upload feature that takes a very long time to work after you click submit-- as long as 30 seconds. It isn't caused by the upload itself; that happens very quickly. I don't know what it is, and it makes me nervous, so I thought I would ask.

Could Reddit be doing something with the upload feature that could glean information about me that it couldn't through ordinary browsing?

No.

A browser does not leak information apart from the selected file(s) and the information that can be accessed using JavaScript WebRTC etc. anyways when using the HTML file upload input.
There might be some calculations going on in the background like calculating CRC's until you're able to submit the form.


NMAP NSE script stopping after 900 seconds (15 minutes) I am experimenting with ssh bruteforce over my home network using the ssh-brute nse script. I have a short list of usernames (just 12) but a long list of passwords (1M).

I can't seem to get the ssh-brute script to run longer than 900 seconds before it terminates and reports:

PORT   STATE SERVICE
22/tcp open  ssh
| ssh-brute:
|   Accounts: No valid accounts found
|_  Statistics: Performed 1556 guesses in 900 seconds, average tps: 1.9

Nmap done: 1 IP address (1 host up) scanned in 903.62 seconds

I've read the docs for ssh-brute, and for the brute, creds, and unpwdb nse libraries, but I can't see any options or information that might be relevant (though I might have missed something). I have also searched man nmap, the online docs and googled for information as to why it might be terminating after 900 seconds/15 minutes, but the closest I could find is the description of the -T5 timing template, which times out an individual host after 15 minutes without reporting any results for that host, which didn't seem to match my problem. Nonetheless, I tried to manually set --host-timeout 48h, but that doesn't change the behaviour.

Any clues as to what's causing this, and how to get the script to run longer than 900 seconds?

The documentation for ssh-brute.nse mentions:
unpwdb.timelimit
https://nmap.org/nsedoc/lib/unpwdb.html#script-args

unpwdb.timelimit
The maximum amount of time that any iterator will run
before stopping. The value is in seconds by default and you can follow
it with ms, s, m, or h for milliseconds, seconds, minutes, or hours.
For example, unpwdb.timelimit=30m or unpwdb.timelimit=.5h for 30
minutes. The default depends on the timing template level (see the
module description). Use the value 0 to disable the time limit.


Can SSL traffic encrypted with a weak cypher be bruteforced? Take the following scenario:

Attacker performs a man-in-the-middle attack on Client, redirecting the DNS records of www.example.com to point to a malicious server
Client connects to the malicious server that completes the SSL handshake using the public key of www.example.com, and negotiates a weak cypher, eg. DES 56/56
Client sends a request to the malicious server, which is logged

At this point, the server disconnects, and the client never gets a response. Is it possible for the attacker to bruteforce the contents of the client's request?

The scenario you exposed is not possible for the reasons described by Dave Thompson as in comments.

However, the concept you are talking about is called a SSL downgrade attack and occurs when the eavesdropper is able to alter the initial handshake. For exemple: breaking the connection to force the client to retry with lower SSL/TLS version: https://p16.praetorian.com/blog/man-in-the-middle-tls-ssl-protocol-downgrade-attack

At this point, crypto-attacks are possible but they don't actually rely on bruteforce, except if a very weak cipher is used, but forcing user to use weak SSL version AND weak cipher suite is pretty hard. Most of the time, a cryptographic implementation flaw is present in older versions of SSL and allow to decrypt data in a certain way.

If one day you can intercept DES 56 bits stream, you can assume that, yes, it can be bruteforced with modern computer and in a easier way with dedicted cloud computing


Accounts being accessed from X country So recently I've been getting emails that X account has been accessed from Y country with an IP address that I obviously don't own. An example would be my Steam account which recently got accessed from India (but got foiled, hooray 2FA).

The problem is that I have no idea where the breach is coming from and how it's happening. My system is clean as far as I know, my network is more secure than a regular home network, I'm the only one using said network, I'm not using any caching/proxy/VPN servers, and I definitely have never been to India/Iran/Taiwan/etc.

The other problem is that I know someone definitely has a copy of my plaintext password(s) since, from the example above, Steam Guard only kicks in when the correct password is entered.

Changing passwords for all my accounts is out of the question since I have over 300 accounts spread across the web (which I think where the breach originated). My key accounts (email, social media, finance) are all protected by 2FA.

As a sysadmin admin-ing my own stuff, what measures should I take aside from the usual tips about breached accounts where the threat is unknown? (since usual advice usually assume the threat is known as far as my research yields)

Related: 1 2

Are you sure that changing your 300 passwords is out of the question? Would you rather open 300 support-tickets to reclaim your accounts?

You should think about setting up a password-database like KeePass2 or simmilar in the process of changing you passwords, this will help you setting different passwords for each account.

The threat seems to be the person or group that got access to your plaintext password. If you got no idea how this could happen, you should not consider your system clean and do a reinstallation of all your boxes.


How to fix specific XSS issues in URL via php? I am using Netsparker community edition for checking my app for any general security holes.  I'm getting a lot of following XSS probable issue areas:

my_php_file.php?nsextt=" stYle=x:expre/**/ssion(alert(9)) ns="

Code in my_php_file.php is not accepting any $_GET or $_POST parameters.

So how I am supposed to fix this sort of XSS problems if I'm not even using those $_GET or $_POST parameters?

Also in pages where I do use $_GET params I get this:

my_php_file2.php?id=" stYle=x:expre/**/ssion(alert(9)) ns="

I do filter all incoming params (for example id from last snippet):

trim(htmlspecialchars($_GET['id']));

And after all that I even run result of previous in preg to allow only digits in that id param.

Could someone would so kind and advise me what those XSS alerts are all about? How to approach them?

I suggest you read about defending against XSS.  OWASP has good resources.  You need to apply proper input validation to all input values, and properly escape all dynamic values that you insert into the output HTML document.  There are many online resources on how to prevent XSS.

As far as your specific application, you haven't provided us enough information to diagnose the issue.  Did you try opening my_php_file.php?nsextt="..." in your browser, to see what happens?  Does an alert dialog pop up?  If you view the source of the response, do you see a "style=..." attribute anywhere in the response?  Also, though you say you don't use any GET parameters in my_php_file.php, is it possible that code in my_php_file.php might include another PHP file or might call some other function that produces unsafe output?  I suspect you may have an XSS vulnerability that allows injection of a new attribute into the middle of some attribute list somewhere.

You mention the approach you are using to sanitize the parameters on other pages.  I'd like to mention that this is not the proper input sanitization method.  strip_tags does not prevent XSS (strip_tags is not guaranteed to remove all tags; and even if it did, removing all tags is not sufficient, as one can still mount an XSS attack by injecting attributes without injecting any new tags).  A good rule of thumb is that if you're using strip_tags, you're probably doing something wrong.

More generally, input validation is not about blindly throwing every stripping function you can think of the data.  Instead, you should check that the input matches a suitable whitelist or regexp, as appropriate for the type of the data.   And, when you output the data, you should escape it  in a way that is suitable for the context where the data will be inserted.  For instance, if you are inserting it into the standard between-tag HTML context, you can escape the data with htmlescapechars.  If you are inserting it as a link (as the value of a href attribute), then you need to ensure that it is a properly formatted URL with a safe scheme (http or https are safe; javascript is not).  There's a lot more to say about input validation and output escaping: see the OWASP resources for a lot of great information on this topic.


Manage Logs of Excessive Member and Server Authentication Failures Currently, in our SIEM environment, we are attempting to reduce noise and any non-actionable items. One of the most frequent items we receive on a weekly basis is a report based on excessive member and server authentication failures.

The overall concept is to inform us of any accounts that consistently fail authentication on a host over a 24hr period, where no successful events are seen within the same 24hr period. We often determine the type of failure based on the event code that it is producing as well as the signature/signature ID.

Our standard process is to contact the account or server owner and have he/she investigate what is causing the excessive failures. This process can be rather lengthy and time-consuming and is dependent on analyst communication to the account owner. I'd say 95% of these alerts are not actionable or they are closed after a follow-up SIEM search.

To avoid a possible brute force attack we do monitor these logs. My question is; is there an additional layer of filtering or rules that be tweaked to reduce these logs.

Common Event Codes:

4625
4776

Also is there perhaps a different process that can be utilized for monitoring and reporting such excessive accounts. At, the moment we need to create a new tracking ticket for each and every account that meets our current standard and/or threshold.

Through analysis, I would believe that if an analyst can determine if the failure is indeed a brute-force is actionable than we would then complete the required steps. Otherwise, these excessive failures can be reviewed and forwarded to the respected account owner as needed.

Any thoughts on the matter? Thank you!

It is true, as you said, that both event IDs can be very noisy
  (especially ID 4625). However the way how to handle those event can be,
  from my experience, improved with the following suggestions.

On the first hand, and if your aim is to improve your process, I would suggest to review the way you group and manage those events in your SIEM (whatever it is). Actually, analyzing each event as a single event can turn out into a waste of time and total loss of visibility. What would be interesting is that you group events and count (with thresholds) for example the amount of time that a source IP, a user or a target is seen during a failed login attempt. This can be done creating some advanced brutforce rules/scenarios/use case. Below I provide you a concept that I have done and that I have implemented. On the left you have the different parameters than can be adjusted and on which you should group over or not. Risk means the criticality level of the scenarios when you alert and thresholds the variable you should adjust for the scenario/use case.

You will notice that I don't group over the error code. This is because I consider that an attacker can produced different results during a brutforce attack. However, you can still build specific use cases for specific errors (lock-out, disabled, expired, un-existing accounts ...).

On the other hand, if your aim is also to reduce the amount of those events, I can suggest the following actions:

Increase priority on failed login attempts on specific assets (sensitive servers, DMZ servers, databases, domain controllers, PKI, ...)
Focus on failed logins on sensitive accounts (eg: service or admin accounts)
Ignore lock out failures on user accounts until they remain under your lock out policy thresholds
Correlate failure events (ID 4625 and 4776) with the events produced on the source machine (ID 4648). This may allow to detect Pth or lateral movement attacks. You can use the following table of failure/success events to make the link between source and target and enrich your output for your analyst.

Correlate failure events IDs 4625 with Kerberos events (ID 4771, 4768) to enrich the results that the analyst will need to check
Ignore some specific error codes into your main use cases BUT make out of it a new use cases with lower priority. You will check those incidents later. As an input, I can provide you the following extract of error codes for 4625 to filter out what you need:

  So I hope this bunch of information will help you. But keep in mind, correlation in the key to reduce load, false positive and increase visibility.


Rounds in a hashing function First of all, Hello! I'm new to the site, don't know any english equivalent to "yoroshiku".

So, I was reading the SHA-512crypt generator documentation and found the part:

  The default number of rounds for both algorithms is 5,000. To ensure
  minimal security and stability on the other hand minimum and maximum
  values for N are enforced:

  minimum for N = 1,000

  maximum for N = 999,999,999

Bery interesting since in my humble mind if you apply to many rounds in a hashing function you could end up with a collision bringing you back to square one of the hash.

Am I correct? or is my understanding of collisions wrong?

The way I see, you can both cause a collision with too long plain texts or with too many applications of the same hashing function.

Sorry for any grammar errors, I'm not a english-native speaker.

I believe that in this context yoroshiku can be rendered as the hope of a long and productive presence on Security.StackExchange :-). So, Welcome!

You are partially correct in your understanding of the collision problem; the risk exists, but if the algorithm has a "flat" enough output, the risk is essentially the same whatever the number of rounds.

The "security" that is increased by incrementing the number of rounds is the assurance that anyone attempting to generate large numbers of hashes (e.g. for a brute force attack) will require a suitably unlikely amount of computing power.

Let's say SHA-512 with 10,000 rounds costs ten times what SHA-512 with 1,000 rounds costs. Then, enumerating 10K round hashes for whatever purpose will take ten times as long than with 1K round hashes.

Usually, in most applications the "happy day scenario" involves only one call to the hash function (e.g. you're hashing the password supplied by the user). So we can use a high round number, and still allow the user to experience a negligible delay.

  The way i see, you can both cause a collision with too long plain texts or with too many applications of the same hashing function

Yes, but you're only comparing calls with the same number of rounds. Say that for example 10K-round hash of "foo" is abcdef, and 1K-round hash of "bar" is too abcdef. This is a collision of sorts.

But when the system is run, it will not use the hash result at every round; it will wait until it has completed the 10Kth round before returning the hash. It will never even know that a "collision" was generated at round 1,000.


What does a collision attack accomplish for an attacker? I was installing a CA on a Windows server 2012 machine, and it asked what hash algorithm I want to sign the certificates with (MD5, SHA1, SHA256, etc). I read that SHA256 is immune to collision attacks while older methods are not.

From what I understand the CA uses this hashing algorithm to create digital signatures. Like when a server asks the CA for a digital signature so people can trust it, the CA hashes the the server's certificate then encrypts it with the CA private key. Then the server will send this digital signature to its clients so they can trust it.

So what I'm wondering is what difference does it make if you choose a more secure hashing method over another in the CA setup? Like what difference does it make if an attacker finds something that produces the same hash as the one in the signature? He doesn't have the private key of the CA nor the private key of the server, so what would he accomplish by doing a collision attack?

Edit: That links don't answer the question.

You may be mixing up a collision attack with a second-preimage attack. The difference between the two is in what the attacker controls: in a collision attack, the attacker has to find two strings that generate the same hash, and the attacker gets to choose both strings. In a second-preimage attack, the attacker has to find a string that generates the same hash as a given string that the attacker cannot control. See the answers to this question for more info about the difference.

You asked "Like what difference does it make if an attacker finds something that produces the same hash as the one in the signature?" -- here, you're describing a second-preimage attack. If that were possible, an attacker could use it to generate a forged certificate with the same hash as the valid certificate, and then simply copy the signature from the valid cert to the forged one; since their hashes match, the signature will match as well. This would result in a complete failure of certificate security. But (at least as far as I know) there's no hint of a practical second-preimage attack against SHA-1 (or even MD5), so this is pretty hypothetical.

The risk of collision attacks (which are possible against both MD5 and SHA-1) is less direct. The problem here isn't with your actual server certificate; you could actually use MD5 for that, and connections secured with it would be fully secure. The problem is that an attacker can generate two certs with matching hashes, one of which will look OK to a certificate authority, and one of which is completely invalid. They submit the OK one to a trustworthy CA, get it signed, then transfer the (valid) CA signature to the invalid cert, and then use the invalid cert (with valid signature) for whatever they want. Including simply replacing the (valid) cert from your server.

This is not hypothetical. In 2008, a group of researchers from the Chaos Computer Club used this process to forge an intermediate CA certificate with a valid (MD5) CA signature; since the forged cert was a CA certificate itself, they could then use it to sign anything they wanted (although they intentionally created it pre-expired, so it couldn't actually be used). See this CNET article.

In order to avoid being fooled by forged certificates like that, clients must reject MD5-signed (and probably soon SHA-1-signed) certificates. And that is why you should sign your certs with SHA256 -- it's not that MD5 and SHA-1 certs are insecure, it's that clients can't tell they're secure, and therefore have no good choice but to reject them. See my answer to a similar question here for more details.


Can multiple SAQs be used for PCI compliance? If we have a SAQ A compliant website for online signups, can we also use SAQ C-VT for phone orders? I'm thinking yes since they're separate payment channels but this aspect is new to me.

There is a relevant FAQ from the PCI SSC that addresses this questions. The gist of it is that you if the environment meets the criteria for the SAQ then you can use that SAQ as a reference for the requirements you need to meet for that environment.

In practice you would complete SAQ D and evaluate your responses based on how they pertain to the two environments. Each legal entity should only complete one SAQ or ROC for the entire company. To complete multiple SAQs would be misleading, as you can't answer truthfully to all criteria needed to complete either the SAQ A or C-VT, as the requirements for doing so apply to the company as a whole, and all SAQs besides D have stipulations that there are no other cardholder data flows.

When conducting your review, if neither SAQ A or SAQ C-VT contain a particular requirement, meaning the PCI SSC has deemed it not applicable for a particular  type of environment, you can mark it as N/A in the SAQ D you are completing. If either one of them contain the requirement then you should evaluate how you are meeting that requirement for the related environment and document it accordingly.

The key to this method, as it states in the FAQ, is clearly documenting and explaining the approach you are taking in the Executive Summary of the SAQ. You need to clearly document and explain how the two environments are separate and individually qualify for a given SAQ, and the approach for evaluating each requirement for compliance.


How can I protect against email tracking services? Recently a free service came out for email tracking, bananatag.

It's able to track the fact that the email was read in gmail without any notice or strange inclusions in the email body. In this case I have two questions:

How can I block the bananatag?

How does actually this service work?

It's all in the knowledgebase: https://web.archive.org/web/20140926051535/http://blog.bananatag.com/knowledgebase/how-opens-work/

  We use the same technology as mass-email-marketing companies to track our Opens.  This is achieved by inserting a small image in the message or Tracking Pixel into the message.  When the image is downloaded you get an Open.

As a recipient of such a message who does not wish to be tracked you must either block image fetching from the bananatag servers (assuming they are easily identifiable), block images which look like tracking URLs or are smaller than a certain size, or simply block images altogether.


index.html integrity Is it possible to make browsers verify that index.html matches some checksum?

Context:

With subresource integrity, you can specify SHA hashes for URLs, so that you know that you are getting the correct javascript and css files even when they are pulled from a CDN that doesn't use HTTPS.  See:

https://developer.mozilla.org/en-US/docs/Web/Security/Subresource_Integrity

<script src="https://example.com/example-framework.js"
        integrity="sha384-oqVuAfXRKap7fdgcCY5uykM6+R9GqQ8K/uxy9rx7HNQlGYl1kPzQho1wx4JwY8wC"
        crossorigin="anonymous"></script>

It would be nice if something equivalent can be done with index.html.  If e.g. DNSSEC can be used to deliver a text record with a hash of index.html then it's possible to get index.html securely, knowing that it hasn't been tampered with, without having to rely on https.

Imagine, a green badge over HTTP!!!

Is it possible?

Yes, in theory, it is possible to define a checksum for the index page of a website. If browser vendors wanted to support such a thing, it could definitely be done. Similar mechanisms for SRI and CSP already exist.

However...

It doesn't make any sense. /index.html pages used to be integral parts of the web, back when it was mostly static. However, most content is generated in a dynamic fashion. For example, if you look at the "index" page generated for this website, you will see that all the dynamic content from the Stack Exchange network, such as your avatar, your username, your reputation and questions currently being asked, are all generated server-side.

That means when you visit https://security.stackexchange.com, you will be delivered a different document than me, or anyone else.

This alone renders your approach completely infeasible. But there is more.

It doesn't make sense

Subresource Integrity solves a particular problem, and you seem to fundamentally misunderstand this problem. You said:

  With subresource integrity, you can specify SHA hashes for URLs, so that you know that you are getting the correct javascript and css files even when they are pulled from a CDN that doesn't use HTTPS.

But the goal isn't to replace HTTPS. The goal is to prevent a bad actor from replacing the legitimate jquery.min.js with a malicious version. If your site specifies how jquery.min.js should look like, then your browser would refuse to execute a malicious version. It was created in a response to the "single point of attack" we created by putting all our JavaScript into one domain.

Furthermore, it doesn't solve any problem at all. You said

  Imagine, a green badge over HTTP!!!

but that isn't even a desirable goal. HTTP is fundamentally insecure and should die. It should have died last decade, for all that security is concerned with. HTTPS solves all the problems HTTPS would need to solve. And with Let's Encrypt, it's literally free and takes five minutes to get a trusted certificate for HTTPS. There is no reason to keep HTTP around even longer.


Is it OK (from a security perspective) to add only the the server cert to client trusted store with out adding the root Certificate in SSL? Is it OK (from a security perspective) to add only the the server cert to client trusted store with out adding the root Certificate in SSL?
In this case whether handshake completes successfully?

Yes.  What you are asking about is often called "certificate pinning".

When you add a signing cert or root cert to your trust store, you are saying, "I trust all certs signed by this cert".  By adding the cert to the client's trust store, you are saying, "I explicitly and directly trust this cert".  In the former, you are implicitly trusting many certs, in the latter explicitly trusting exactly one cert.

There are some things to be aware of.

Some clients might not support this model.  If it's third party software, you'll want to test before you deploy this way
you'll need a secure way to deliver the cert to your client. This mechanism has to be trusted and must prevent other, un-trusted certificates from getting onto the client. Web Browsers get their default certs from the browser manufacturer, your OS manufacturer,or from your IT department. If you're going with web browsers and it's for users outside your company, this will be much harder - they can't just connect to your non-root-chained site get a certificate warning and add the cert to their store, as they will have no way to know if they're connected to a malicious site.
you'll need a secure mechanism to rotate the certificate when it expires or is compromised.
testing your client app may be challenging. You'll want to connect your client app to a test server, which means you'll need a way to set your client app to use the test server's certificate.

You also get some advantages over using root or signing certs in your trust store

if it's your custom app and nobody else's certs are in the store, you get a guarantee that clients are only communicating with your servers (until someone replaces the client's trust store)
root/signing certs use certificate revocation lists for cert revocation, but nobody monitors those. Your approach will simply replace the cert in the client trust stores to effectively revoke a compromised cert.
there is a smaller attack surface. In the web browser standard model, an attacker could go after any trusted root, any explicitly- or implicitly-trusted intermediate cert, or the leaf cert.  With cert pinning, only the leaf cert is a target*

*I intentionally ignore attacks against the software, against weak crypto, and against client trust stores, since that's all common to both scenarios.


TOR communication from exit to origin hope this question has not been asked like this before - I've seen something simillar but could not understand the process. So my question is
regarding TOR communication:
origin -> destination and
destination -> origin.

From what I understand when I as a source (lets say IP ABCDE) send a package to twitter (lets say IP 12345) via the tor network, I connect to an entry point in the tor network. When the package leaves the entry point to some other tor server, the origin of the package (my IP ABCDE) is gone, either decrypted or deleted. The tor nodes only know the target (twitter) and route the package via node connection tables, where only the next and the previous step in the chain are known to one node.
Even if that's not fully correct, from my understanding twitter will recieve a package with the content I sent, but from the IP of the tor exit node (lets say IP 67890). At this point twitter has no knowledge of the origin.

Now here is the question - if twitter (or to be more precise, the twitter server that sends the package response) does not know the destination, how does the package end up back in my client browser? At some point in the tor network, the real origin (my IP) has to be stored and if so, at which point is it stored?
Because if that is true, when I get access to the entry point and can see all network traffic, it should be possible to identify the origin and target of a package. What part do I not (or not fully) understand, since I must be overlooking something....

I'd be glad about a fairly simple explanation with an example if possible as I'm quite new to the subject (pretty obvious I think).

Edit:
I've read this thread, but it does not answer my particular question.
Quote:

  The webserver sends the packet to the exit node, because the exit node was the computer that connected to the webserver. The exit node uses a table (seems like the NAT table, but with more information) to decide where to send the response. So it will encrypt the packet again, and send it to the next node, which will do the same, until the packet reaches your computer, are decrypted locally, and sent to the application.

Here it's not specified where the original sender of the package (me) is stored and how I am identified within the tor network. I get that the navigation from original tor exit (now entry for twitter) knows how to get back to the initial entry point where I sent my package to. But how does this node know that I am the original sender? And if the entry node has this information, isn't the tor network easily compromised by hacking into the entry node (if it's "labeled" as such)?

What you're asking about involves knowing the details of the TOR protocol design.  The Tor White Paper explains everything in detail.  Look to section 4 (4.1-4.3) contain the design portions relating to circuits and streams.

The summary is that underneath the layer of TLS there are 512 byte cells that describe how Tor routers talk with each other.  There are control cells and relay cells that are laid out as follows:

Control Cell

+---------------------------------------------------------+
| CircID | CMD |                 DATA                     |
+---------------------------------------------------------+

Relay Cell

+---------------------------------------------------------+
| CircID | Relay | StreamID | Digest | Len |     DATA     |
+---------------------------------------------------------+

This is how each piece of data knows what stream and relay it is associated with, as well as the circuit.  Each Tor router will likely keep some type of "Tor policies" to ensure they keep track of these circuits, relays, and stream IDs.  Much like ISAKMP/IPSec handles its traffic.  Whatever Tor uses as a daemon on the router would handle this management.


Is the Windows paging file safe in the encrypted partition? I came across this setting called ClearPageFileAtShutdown. The setting is described here and says:

  If you are truly worried about security, boot Windows off a fully-encrypted drive. Then you needn't worry about your sensitive data being unencrypted in the paging file.

Basically, it implies that the paging file, even if it resides in an encrypted partition, is not safe--the drive must be fully encrypted for it to be safe. Why?

My understanding is that data is either stored in memory (which will be gone if no power is out regardless of whether a proper shutdown was initiated) or resides in the paging file of an encrypted Windows partition (which is obviously decrypted when system is in use but is encrypted otherwise?).

This topic is particularly important to me because I dualboot Windows and Linux and I encrypt the former with Veracrypt and the latter with dm-crypt on an SSD--the remaining space is unencrypted unallocated data (which as far as I'm concerned, is not a security issue but based on the article above, it is).

In addition,

  Even if you use encryption to protect sensitive data on the hard disk drive, the encryption key (and decrypted data you are accessing) would be stored in the computer's memory. Windows will automatically map out some of these data to the paging file, which remains unencrypted even when Windows shuts down.

Again, how is the paging file unencrypted when Windows is shut down if it resides in the encrypted Windows partition by default? Why is it necessary that the entire drive is fully encrypted and not just simply the Windows partition?

Thanks.

Microsoft (among many others) uses somewhat confusing terminology at times. In this case, "drive" is used in the sense of "drive letter". This is distinct from a "disk", which is a physical storage device. A drive's data may be stored on a physical partition, but the storage location for a "drive" is most properly called a "volume". It might be one partition, or multiple partitions (spanned, or striped, or RAID5, or whatever), or a CD-ROM, or an image file mounted from some other storage device... you get the idea. "Drive" does not refer to the entire disk; even on things like SD cards (where there's usually only one volume per physical "disk"), the disk metadata is outside of the logical volume that gets mounted and assigned a drive letter.

To directly answer the question, if your paging file is stored on an encrypted partition (which is typically your C: drive, and encrypted via something like BitLocker or TrueCrypt/CipherShed/whatever), you're fine. Well, as fine as the encryption on the partition is, but the important point is that sufficiently good whole-volume encryption is fine; you don't actually have to encrypt literally the whole disk.

The distinction Microsoft is making is between full-volume encryption (stuff like BitLocker) and more granular encryption (such as file encryption via Encrypting File System, encrypted ZIP archives, data encrypted with PGP, and so on). BitLocker is usually referred to (by MS) with either the abbreviation FVE (for "Full Volume Encryption", as in fveapi.dll or fveprompt.exe), or the abbreviation BDE (for "BitLocker Drive Encryption", as in manage-bde.exe).


Deriving digital signature key pair deterministically from an arbitrary secret Is there a scheme that let people derive public/private key pair from arbitrary secrets?
As you may know, digital signature schemes have versatile use cases. The problem is, the key pair handling is too difficult for end-users. On the other hand, the concept of password is pretty much ubiquitous; people can handle it without much difficulty.
To enable digital signature for end-users, there must be something or some scheme that bridges the gap.
I can't imagine how non-techies can use ssh-keygen to establish their digital signature and carry the private key around securely, hence the question.

It's possible, but there are some caveats to be aware of.
At first glance, it might seem that ECDH lends itself well to this, as an ECDH private key is nothing more than a 256-bit value.
So, in theory, you could simply take the SHA256 hash of your password, which will return a 256-bit value, and use this as the ECDH private key.  Then, the ECDH public key can be derived from the private key.  However, if your password is easily guessed, or appear on list of known passwords (such as rockyou.txt), your private key may be easy to crack using a rainbow table.
To mitigate the above problem, keys are often derived from passwords using a random salt, and many rounds of hashing (e.g. PBKDF2).  However, in your use-case, this poses the problem of where to store the salt?


Are any Java Card 3.0 smart cards available? The Java Card 3.0 specification (draft?) came out in 2008. It is now 2013. Are there any existing smart cards that actually implement the specification? How about USB tokens?

The best I've found is Java Card 2.2.2 + ECC functions from 3.0.

If Java Card 3.0 seems dead in the water, are there any good alternatives? A cheap and secure programmable device that can do custom key generation and cryptographic operations inside the device.

Found the solution myself.

There is one smart card platform that implements Java Card 3.0.1 Classic, available as a smart card and as a USB token:

Sm@rtCafé Expert 6.0
StarSign Crypto USB Token

There also seems to be some similar card from CardLogix.

However, these are all Java Card 3.0 Classic, which is very close to Java Card 2.2.2. The minute differences are easily implemented by card manufacturers, so it seems that most cards will probably update to Java Card 3.0 Classic eventually.

The case for Java Card 3.0 Connected seems a lot bleaker. Nobody has come up with a card, and I couldn't find any information about cards in the making either. It would seem that the requirements are a bit steep for current generation cards and there are not many use cases for such cards.

Unfortunately, even ignoring the HTTP servlet stuff, only Java Card 3.0 Connected edition is the one supporting Java 6 with threads, full types, generics, etc. Java Card 3.0 Classic is still using the 16-bit Java with very few features.


Do opensource rootkits exist for Android? I've been reading a few articles lately that talk about Android botnets which rely on security flaws in old Android versions to get root access and take over the phone.

Obviously this is pretty bad from a risk perspective, as plenty of Android's are running on outdated versions. I know there are individual exploits like those on the exploit database https://www.exploit-db.com/, but I'm interested in evidence of a rootkit that leverages several known vulnerabilities to target multiple different devices and/or versions.

Yes. I suspect there are also others that may be more feature-rich. Searches for these in other languages may also be useful for finding others.

https://github.com/hiteshd/Android-Rootkit

Although not technically open source you may want to look at the Hacking Team dump that was in the news a while back some of the code from that may be of interest to you.

https://github.com/hackedteam?tab=repositories


Hidden network continually connecting that I cannot disconnect Whenever I boot it connects. There is no option to disconnect it except to uncheck the "connect automatically" box, but it stays connected even if I reboot.

What is going on here?

Also, I cannot turn Windows Defender on. When I try, Windows tells me that antivirus protection is being performed remotely. This was not part of the contract when I purchased this laptop and my employer continually tells me that they are not the one who is connecting through the hidden network.

So, since my employer obviously doesn't see that this is a monumental security issue, I feel obligated to correct this problem before our network is compromised, infected, and my data is lost or corrupted.

I do suspect that my employer is lying through his teeth, but just in case he claims to know nothing and is not bothered by this issue, I want to simply take care of it since that's the right thing to do for every reason.

What can I do to delete this hidden network and lock anyone else out who may try to get back in?

Here's a screenshot. When the machine boots it always shows that it is connecting a hidden network!

I would suspect some kind of Antivirus program is installed locally on the computer and is managing Windows defender remotely and has also connected the Hidden Network. Most likely it doesn't mean that it's connecting you to remote servers, although it may do that as part of its operations, rather that it has installed some kind of network adapter in order to route all traffic through the program to make sure nothing bad comes in the door.

There are two places to look for more information. One is to right-click on the wifi icon in the status bar and click Open Network and Sharing Center. The other is the network adapters page, which can be accessed from the network and sharing center. If you would post a screenshot of the Network and Sharing Center window, it would be helpful, but make sure you blank out the network name before posting. The network adapters page would also be good, just make sure you blank out any network names (but not adapter names).

If you do not wish to post these screenshots, that's fine. These two windows are where I would go to find more information like you are trying to figure out. Look for a blue link next to the label Connections on the Network and Sharing Center window and click on it. That will give you the adapter info window for that specific connection.


Privacy data concern: Facebook account appearing with a search for phone number, despite it never being added - what should I do? Something that's concerned me recently is "doxing" or the searching for and posting of personal information. Recently I carried out essentially an audit of my personal security online and discovered a search engine that is for exactly this purpose.

Curious, I put in my phone number and was shocked to find that this returned my Facebook profile.

I have never added my phone number to my Facebook profile, but I did have the Facebook app installed on my device previously.

How can I remove such details from my profile or at least ensure that this information is hidden better?

There isn't much you can do about it besides deleting your Facebook profile (different from deactivating it - though I'm sure in both cases nothing is really deleted).

As for how Facebook got your number - they have a feature in their mobile apps which allows people to upload their contacts to Facebook - if many of your friends had this enabled (and the app is really pushy about enabling it), eventually Facebook will realize "that many people have this number for this person's name - it must be their number".


Strange Problem - DNS Cache Poisoning? I'm a developer by trade, but not that well versed in information security. I've encountered a strange problem at home:

About three times now in the past year, when I open some website - I'm thrown to some garbage domain which tries to phish me to do some kind of security audit or whatever. First time it happened - I thought I had some malware on my system. I'm normally very cautious. So I pretty much burned my drives and got a fresh everything going. Then it happened again, a few months by, and now again - after moving to a different apartment and on my GFs laptop.

I'm suspecting DNS tampering of some sort, but there's no way to verify. Opening the same domain again, just gives me the right page.

Between now and then I moved apartments, moved ISP, changed router to Google Mesh, changed DNS to 8.8.8.8 on it. So... now even DNS poisoning doesn't make much sense.
And the websites that do open, are very similar in spirit. I suspect that the problem is persistent.
AV software doesn't report any issues.

Any ideas? And what should I do to prevent this?

EDIT:

In response to questions:

It happened to three different websites. I honestly don't recall which, I think it's entirely possible that it wasn't any of the big ones.
Visiting the same site again just opens the normal site.
Last time it happened yesterday (my GF visited some blog. I will update again if she remembers which site it was originally), and this is the garbage result I was referring to: http://play6052.try-it-now3.club/?utm_medium=oxxGrJ1EO8rl%2flkgHhDHtdaJe%2b6y3ml38Z%2b1ZX9QaLo%3d&t=main6_mcas2
I am in Estonia
The browsers and machines are completely different. Even the router and ISPs have changed between issues.

EDIT 2

The offending original was:
http://www.byronkatie.com/2018/07/how-to-be-safe-in-the-abyss-the-work-of-byron-katie/

I agree with Steffen, this sounds like malvertising as the most likely cause, with a less likely option being compromise of the visited site with embedded redirects.

Running ad-blockers and script-blockers is effective against most malvertising, but can negatively affect your browsing experience.

Sometimes malvertising is targeted at only certain browsers. I used to have a site I visited regularly that suffered from frequent malvertising on the mobile version. Switching from Chrome to Opera solved that problem entirely. Ads still loaded (I wanted to support the site) but not the malicious redirects.


Should I delete lost GPG key from GitHub? I've been using GPG key for a while to sign commits on GitHub. However, I recently lost it by accident when moving data around. It haven't leaked anywhere and signed commits can be trusted, I just don't have private key anymore.

So, should I delete public key from my GitHub account? This will remove "signed" mark from commits which seems to be wrong in my case when I just can't make any new commits with it.

I don't see any reason, why you would need to remove it. Losing the key changes nothing about its security. The key could have leaked, or could be broken later but that applies to a key you did not loose as well. You should rotate your keys in general.

In my opinion, it would be a better idea to keep it for as long, as you trust the key, so people can see you still trust the signatures. You can likely remove it, once the commits signed by it are no longer relevant.

A commit hash includes the hash of the previous commit, which means a single commit signed with the new key verifies all commits that came before it. Hence, the old key is only relevant, if some branches don't have a new commit or if the users work with old versions of the code.


Ghost CMS abnormal access I have a blog hosted with Ghost CMS. I created a new blog post (say "My New Blog") and correspondingly there was a url generated (mysite.com/mynewblog/)

The weird part is that I saw an access to this post within 2 minutes of creating it. And ever weirder: the access IP was from China (IP to location).

Even if I assume that the CMS reports new blogs somewhere central, why would that be China? The access log looks like this:

61.178.78.96 - - [20/Jun/2015:14:32:32 +0000] "GET /mynewblog/ HTTP/1.0" 200 - "-" "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)"

Is someone in my webserver?

There are constant scans being performed all over the Internet constantly. These scans include crawlers that follow every link that they can find. I am not surprised at all that you had someone access a link you created, even in such short a time.

From the few details you provided, I do not see any reason to believe that someone has unauthorized access to your server. Your server is public and anything you post is public, too.


Process authentication for Linux Is there any possibility to authenticate a running process in Linux to be sure that this is the original/right one?

I know that an Linux operating system is only that secure like the way you use it. For Example: Lets say I'm using Ubuntu Linux and install any software via a PPA, that software get rights to do everything it want's in my system, because I have to install it with sudo rights. (PPA's are in general a security problem in Ubuntu I think)

Let us assume the "bad guy coded software" installs the things to do the work I expected, e.g a Gnome-Theme, a dynamic wallpaper whatever. But also it replaces any process of my Ubuntu system with a key-logger or any other kind of malware and runs in my system.

Is there any chance to check a running process in Linux if it is the original one?

The running processes are easy to get/find out and the processes of the OS and also the processes from a Ubuntu apt repository are known, so I guess there could be a possibility to compare the code of the running processes with any database of known Ubuntu repository software/processes and known Linux software/processes.

Is some kind of process authentication possible or available for Linux/Ubuntu?

You can know whether a file has been modified by checking a secure hash of it's contents. You can do this manually, or you can use your package manager; with RPM it's rpm -V, with apt you use debsums.

Then it's a matter of checking to see if the process was started using that file. That bit's simple as well: check the proc entry. This keeps track not only of the path to the file, but also its inode number, so if the file is replaced, it will not match. Observe:

[tylerl@tyler-11 ~]$ ./foo &
[1] 26157
[tylerl@tyler-11 ~]$ ls -l /proc/26157/exe
lrwxrwxrwx 1 tylerl tylerl 0 2013-01-16 12:31 /proc/26157/exe -> /home/tylerl/foo
[tylerl@tyler-11 ~]$ ls -l /home/tylerl/foo
-rwxr-xr-x 1 tylerl tylerl 8.3K 2013-01-16 12:31 /home/tylerl/foo
[tylerl@tyler-11 ~]$ echo 1 >> foo
-bash: foo: Text file busy
[tylerl@tyler-11 ~]$ rm foo
rm: remove regular file `foo'? y
[tylerl@tyler-11 ~]$ echo 1 > foo
[tylerl@tyler-11 ~]$ ls -l /proc/26157/exe
lrwxrwxrwx 1 tylerl tylerl 0 2013-01-16 12:31 /proc/26157/exe -> /home/tylerl/foo (deleted)
[tylerl@tyler-11 ~]$ ls -l /home/tylerl/foo
-rw-r--r-- 1 tylerl tylerl 2 2013-01-16 12:32 /home/tylerl/foo

Note two things: (a) the file can't be modified while it's running, and (b) while you can delete it and replace it, the new directory entry will correspond to a different executable, and the proc entry will say (deleted) to warn you of the difference.

Note that I could recover the original file just by running cp /proc/26157/exe ./orig_exe, and then I could examine it as necessary. Files aren't actually deleted from disk until the last reference is closed.


SNORT sfportscan alert format How  can I modify the output alert from sfportscan ?

Ex : output alert_csv: /var/log/snort/portscan.log timestamp,src,dst,dstport,msg

OBS: I can set output for default alert file with this method ?

I Developer a script for filter the sfportscan log and integrate it with OSSEC

SNORT(sfportscan) -> portscan.log < filter.py > portscan-filter.log < OSSEC Regex >

#!/usr/bin/python
a = ""
f = open("/var/log/snort/portscan.log","r")
s = open("/var/log/snort/portscan-filter.log","w")
while 1:
    where = f.tell()
    line = f.readline()
    s.seek(where)
    if line[:4] == "Time": a = line
    elif "(portscan)" in line:
         a = a.replace("\n","")
         line = line.replace("\n","")
         ray = ','.join([a,line])
         print (ray)
         s.write(ray+"\n")
         a = ""
    else:
        pass
f.close()

Output: Time: 01/02-12:34:56.006648 ,10.147.160.122 -> 177.124.192.123 (portscan) TCP Filtered Portscan

And i made this Regex for integrate with decode OSSEC rule: (\S+) ,(\d+.\d+.\d+.\d+) -> (\d+.\d+.\d+.\d+) (\(\w+\) .+)


Unknown bot using Firefox 40.1 user-agent What bot is generating this user-agent?

Mozilla/5.0 (Windows NT 6.1; WOW64; rv:40.0) Gecko/20100101 Firefox/40.1

There was no Firefox version 40.1

From website logs (a) it only ever requests the homepage (b) it never requests robots.txt (c) it originates from all over the world, frequently from ISP hostnames, in thousands of pageviews.

This user agent string is used by a brute force that tries to login as an administrator to a Wordpress site. For me the bot tried about 3000 times within about 18 hours with no success.


What does a common workstation setup look like for pentesting and vulnerability research? I'm a security enthusiast, and am in need of some guidance to get me into the branch. I've always been held back by lack of methodology in my research, and it tends to break down my motivation towards learning and studying new concepts within the field...

My problem is this:

The past few days I've been debating whether or not I should go with Linux or Windows for security research. While most utilities, frameworks, i.e. tools, are more common in Linux environments, I cannot help but feel a bit confused in the area.

Say I wanted to audit/fuzz proprietary software that is only available on the Windows platform. Would I have to do my research through a virtual machine? A good example would be Internet Explorer.

Thus, I'm thinking Windows might be a better way to go, since I can always just craft my own tools for my research, but again: When I actually find a vulnerability, and want to test out PoC code, Linux would be a lot easier for me to conduct the operation.

Not to mention, security is vastly different on each platforms. Thinking in terms of Windows exception handling and so on.

What should I do? Or am I looking at all this the wrong way?

It sounds like you are confusing your work environment with your target environment.

Which OS should you work from? There are far more useful tools in Linux than in Windows. Use Linux (or even a penetration testing distro like Backtrack) as a work environment. If you say that you could roll your own security tools (and why would you when there is a community of developers pumping out quality tools?) then it should not take long to get up to speed in a Linux environment.

Which OS should you become proficient in testing/penetrating/audit/fuzz? That is up to you. The technical side is as doyler says: you can always run virtual machines of either OS. In fact, with only a little virtual machine networking configuring, you could create your own test network with a mix of OS'es.

Which OS should you target from a learning/gaining expertise perspective? It depends on where you want to go with it. And, you might need to provide more details on your goals for us to weigh in on that.


Hackable linux distributions A few years ago we had that awesome Linux distribution called Damn Vulnerable Linux.
But unfortunately it looks like the project is dead. So my question is are there other
Linux distributions which are meant to be hacked (explicit in the view of exploit development). Also welcome would be applications on the Windows platform for exploit exercises (like vulnerable server). Thanks in advance

Vulnhub is a collection of vulnerable distributions along with walkthroughs contributed by the community.

exploit-exercises.com provides a variety of virtual machines, documentation and challenges that can be used to learn about a variety of computer security issues such as privilege escalation, vulnerability analysis, exploit development, debugging, reverse engineering, and general cyber security issues.

PentesterLab has interesting exercises, some o them are about exploit development.

RebootUser has a lab that includes a Vulnix - a vulnerable Linux machine, VulVoIP - a relatively old AsteriskNOW distribution and has a number of weaknesses, and VulnVPN - a VM that you can practice exploiting the VPN service to gain access to the sever and ‘internal’ services.

BackTrack PenTesting Edition lab is an all-in-one penetration testing lab environment that includes all of the hosts, network infrastructure, tools, and targets necessary to practice penetration testing. It includes: a DMZ network with two hosts targets, an “internal” network with one host target and a pre-configured firewall.

PwnOS is a Debian VM of a target on which you can practice penetration testing with the goal of getting root.

Holynix is an Linux vmware image that was deliberately built to have security holes for the purposes of penetration testing.

Kioptrix VM is targeted at the beginner.

Scene One is a pentesting scenario liveCD made for a bit of fun and learning.

Sauron is a Linux system with a number of vulnerable web services.

LAMPSecurity training is designed to be a series of vulnerable virtual machine images along with complementary documentation designed to teach Linux, Apache, PHP and MySQL security.

OSCP, OSCE, SANS 660 and HackinkDOJO are some of the paid courses that have good practical labs.

Hacking challenge websites can also provide challenges that are increasing in difficulty, fun and addictive. WeChall is a website that aggregates scores on other challenge websites and it has a category for websites with exploits.

CTF (Capture The Flag) events have challenges where you are required to exploit local or remote software. Most live events are available on CTFTime but there are repositories of past events and some CTFs are still available after the live event.

But for exploit development, I suggest installing vulnerable applications on your own computer where you could easily perform analysis. The application doesn't necessarily have to be a server or run on a different computer. Go to exploit-db and find old exploits there, then look for that version of the vulnerable software and start working on it. If you need hints, the actual exploit can point you in the right direction.


Are HTML Components (HTC) files a potential attack vector? I'm working on a site that has a higher-than-normal concern for user security. I've recently been working on some CSS issues with older versions of IE (we support 7 and higher) and found that an easy solution to some of them would be the use of HTML Component files (.htc) to add certain CSS3 behaviors.
http://msdn.microsoft.com/en-us/library/ms531018(v=vs.85).aspx

I was given an uncertain suggestion by someone that these methods could lead to a security issue, either on the part of compromising the client browser, or the server (the latter would surprise me). I've tried doing a bit of Google research but couldn't easily find very much mention of any such issues. Would someone here have more insight into this issue?

I'm not super familiar with them but can't see anything unsafe about them in a blanket fashion, I can imagine risks from them being used in an unsafe fashion though, typical owasp top ten type risks from trusting user input too much.

Are you allowing these files/other CSS/html content to be uploaded or edited by untrusted input?  Can untrusted users edit the files on the server? If the client machine is compromised (malware etc) they can no doubt alter it but that's a moot point anyway.

There's mention of htc here too, but seems to fit within the risks above:
CSS based attacks


MAC address encryption I am a student of information technology and I am doing a project on avoiding MAC spoofing by using MAC encryption.

My goal is to encrypt the MAC address inside the packet and send that packet to the router over the WiFi network.

On the router side, I want to decrypt the MAC address from the packet and store it in such a way that no unauthorized user can see that MAC address, thus avoiding MAC spoofing.

I want to know whether is it possible to encrypt MAC address and if it is possible to decrypt that MAC address at the router side?

You cannot encrypt the MAC address itself and "send that packet to the router" - the MAC is required to enable the packet to reach the router and enable the router to send packets back.  It's simply not possible to "hide" the MAC address.

While it's theoretically possible to put some sort of signing (related to encryption) in place, using encryption primitives to attest to the validity of packet-MAC pairings, the protocols do not currently support that to the best of my knowledge.  I think you'll find that anyone approaching this problem does so at a higher level - transport (IPSec) or application (HTTPS).  Not least because any authentication of the physical layer is non-routable; the MAC address only has significance within the local network, and any work done to secure it will not scale more than one hop.

As an exercise allow me to suggest that you perform a packet capture of traffic during at least two routed hops (e.g., at the web client, at the web server, a router in between).  Look at the MAC addresses involved.  They change and have no authoritative relation to the sender or receiver.  Taking the measures you've suggested to secure them would not be applicable.


Data Masking in a database Background

The development team is receiving production data (as Database backup files) in order to fix bugs and application enhancements. The Development team restore these backups in their environment and perform the application development work/bug fixing etc..

Problem

Client is concerned about exposing sensitive production data such as PII(Personal Identifiable Information) to the development team. Client needs to screen these sensitive data while preserving its properties where the dev team can perform day to day work without interruption.

There is no requirement of reversing the screened data.

Probable Solution 1 : Data Masking

As I see the most correct solution for this problem is identify the PII database fields and perform Data masking. One problem we are facing is we need to preserve data properties in the DB such as follows.

The masked data length cannot go beyond the particular field length.
The masked data should be in the same data type as original data : Eg if the DB field type is int the masked data also should be an int
If the masked result of value ABC is XYZ, all instances of data ABC should masked to XYZ (This is because some PIIs are using as DB keys)

Questions

Since we do not need to reverse masked data, can we use hashing to accomplish this? If so , how to maintain the data properties I described above ?
If we are going to use encryption, can we preserve data properties ? What are the best algorithms we do have?
Are there any other techniques do we have to accomplish this objective ?
Can we prevent data Data inference using data masking ?

Data masking is a common request and various vendors have their own solution or rely on 3rd party solutions. You could implement your own (for example using hashing) but as you pointed out, it would be difficult to maintain data integrity, constraints and formats. For example, you might have a national identity column which is validated using modulo X (or some other verification mechanism). How would you mask such columns but preserving the validation?

Using tools already available will solve this for you. Just as an example of features such tools offer (and I'm not implying you should use this specific tool), take a look at Oracle own solution for data masking and subsetting. Quote from Data Sheet describing some of the data masking formats supported:

  Encryption encrypts the sensitive data using a key while preserving the format of the data. This transformation is useful when
  masked data sent to a third party has to be merged back along with
  further updates.
  Format Preserving Randomization (or auto mask format) randomizes the data, preserving the input length, position, the case
  of the character (upper or lower), and special characters in the
  input.
  Conditional Masking masks columns according to different conditions. For example, identifiers that belong to the United States
  can be masked using Social Security Number format and those that
  belong to the United Kingdom can be masked using National Insurance
  Number format.
  Compound Masking groups and masks related columns together. For example, if you want to shuffle address fields like city, state, and
  country, then grouping city and the state will keep these columns
  together during the shuffling process.
  Deterministic Masking generates consistent masked output for a given input across application schemas and databases. This makes it
  possible to mask names consistently or deterministically across different modules across your organization.

I believe these formats fit into your requirements.

Regardless of your RDBMS architecture, the point is the request is common, there is a market for it and on this market there are various vendors who provide the solution. You should choose one of them rather then reinventing your own.


How to convince your boss about importance of IT security Do you know how could I make my security complaints/advices more effective? Or How could I convince my boss about IT security?

There are a couple of known good practices in the field of IT security. My boss seems oblivious to all of them.

Now I am working in a medical platform with real data about patients, prescriptions and it offers functionality to prescribe medicaments and so on. I do not have a vast knowledge in laws about protection of data, but I think that medical conditions are one of the most sensitive.

I have been working in this project just for 2 weeks but these are some of the things I found:

On my thrid day I found a SQL injection that allow you to log in as a doctor (real doctor). When I informed my boss, he told me that it was fine, that they were going to change the login soon. In other words, the injection is still there.

We store the password in plain text. When I complained he said that the medical collective are really special and they would be lost if when they hit "recover password" a new one is created instead of giving them the old password.

At least we store the (other) sensitive data encrypted, like medical history, I think they are obliged by law.

And it is only my 2nd week. It is discouraging to see how my advices fall on deaf ears... But I think it is my duty to notify the vulnerabilities I find.

There's several issues here.

Your immediate concern seems to be that you have not managed to convince one individual of the need for better security. Fixing that will solve the problem - but it may be a big mountain to climb. Greg Dolph's answer already covers this.

The problem here is that your employer is producing a product which is not fit for purpose, and may result in serious damage to your employer, to the users of the product, and to other parties. Unless the organisation which employs you is your boss (and does not have other stake holders / share holders), then you should at least be making other key decisions makers aware that you have concerns which your boss thinks are unfounded.

It's commendable that you are concerned with the security of the systems you are working on, and you have taken the first step to resolving the problem. But if this does become more widely known, then it's likely that those responsible for decision making (or possibly even those responsible for enforcing law/policy) will want to be seen to be taking action - i.e. you need to cover your rear. Try to make sure you've got any verbal discussions noted, preferably minuted. Get copies of all emails somewhere you can access them.

Don't threaten. Don't cajole. Keep calm. Be persistent. Keep records.


What could you do with a PTR record of "localhost"? In today's log summary from my SSH server, I found the following interesting entry:

Illegal users from:
  113.175.205.167 (localhost): 2 times

Doing a DNS lookup on 113.175.205.167 does indeed resolve to localhost (a DNS lookup of localhost resolves to 127.0.0.1, as expected).  What could an attacker be trying to do with such an obviously-invalid DNS record?

An attacker could try to bypass a hostname-based whitelist on your server.

In a naive scenario, you might configure SSH or a firewall to only allow connections from "localhost", intending to lock out all remote machines for security reasons.

A smart SSH server would recognize that 113.175.205.167 is remote and block the connection attempt. Eventually, it would resolve localhost to 127.0.0.1 and see that the IPs don't match.

However, a server with a flawed implementation might first conduct a reverse DNS lookup of the IP, find the localhost entry, and reason that the hostnames match, thus allowing the connection.

NB: Resolving localhost to 127.0.0.1 is obviously done internally in most cases, skipping the DNS query (e.g. by looking it up in /etc/hosts). Hence, a malicious DNS server cannot easily attack the other way round by resolving localhost to an arbitrary IP.

Why does that particular IP resolve to localhost?

Here, it's likely not part of an attack, but because that IP is located in Hanoi and apparently, "The Country of Vietnam Resolves to Localhost". The reason seems to be an outdated technique to bypass e-mail spam filters.


Do ssh logs (from plink) contain secret information? I asked a question on superuser about plink rejecting server keys. Someone previously asked about logs. Does the output I get from plink -sshlog contain any secret information I should not be sharing? When I look at the file it looks like a packet dump of the authentication process. I would assume no secrets are sent but aren't sure.

What is in the log and is there secret information that should not be made public?

From the PuTTY documentation at https://the.earth.li/~sgtatham/putty/0.73/htmldoc/Chapter4.html#config-logging we have the following (corresponding command line options added in [brackets]):

‘SSH packets’ [-sshlog]. In this mode (which is only used by SSH
connections), the SSH message packets sent over the encrypted
connection are written to the log file (as well as Event Log entries).
You might need this to debug a network-level problem, or more likely
to send to the PuTTY authors as part of a bug report. BE WARNED that
if you log in using a password, the password can appear in the log
file; see section 4.2.5 for options that may help to remove sensitive
material from the log file before you send it to anyone else.
‘SSH packets and raw data’ [-sshrawlog]. In this mode, as well as the
decrypted packets (as in the previous mode), the raw (encrypted,
compressed, etc) packets are also logged. This could be useful to
diagnose corruption in transit. (The same caveats as the previous mode
apply, of course.)

Note that no cryptographic secrets are transmitted over the connection; only public keys for authentication and components of the selected symmetric key exchange algorithm (KexAlgorithms) which can be safely logged since they cannot be used by anyone listening in on the connection. Only password authentication appears to be compromised if the passwords are not redacted from these logs.
PuTTY provides options to perform this redaction as the logs are being created: ‘Omit known password fields’ and ‘Omit session data’, which are checkboxes one can use when setting up the session parameters in PuTTY prior to running plink. To use a saved session in plink, add the -load option to the command line followed by the name of the saved session.
Edited to add: This refers only to the credentials and keys associated with the SSH session itself. Applications using SSH as a transport mechanism (such as rsync, sftp, and scp) may have their own sensitive material logged; turning on "Omit session data" may help when troubleshooting an application, but should not be necessary if you are creating a session solely for troubleshooting purposes rather than launching the application.


Responsibilities as a Junior Information Security Analyst? Tomorrow will be my first day as a new Junior Information Security Analyst, and I'm nervous and excited at the same time.

I want to apologize if this is the wrong place to ask such questions, but I think this is the best place to find people who can aid me in this situation.

I've been through a long hiring process, 2 months, including 5 interviews, and a psychotechnic evaluation. I finally got the job.

It may be useful to add that I initially applied to the company for a position as a Junior .Net developer, but during the personal interview, conversation led to which areas are you interested in, and I mentioned Information Security, among others, as I always found that area to be extremely important and interesting.

The interview continued, and a few days after that interview, HR contacted me to offer me an interview for this position "Jr. Information Security Analyst".

During the following interviews some foundational points of Information Security were clarified and explained to me, as well as a big picture of what I will be doing.

Nonetheless, Im a bit confused yet, as I don't know what to expect from my first day at work.
The company focuses in Consulting Services. And they told me that my position is client oriented.
What are the most common responsibilities a Junior Analyst has? What will the company expect from me? Would you recommend any essential books/courses (aside from the company's) to help me grow in the area?

The term 'analyst' is a very, very broad term that can cover very basic and very advanced tasks. In short, there is no way for us to tell you what you will be doing or how to prepare for it. Your company and your boss will define your responsibilities and job description.

Also, the term "Information Security" is a very broad term. It could cover secure code review, firewall administration, penetration testing, forensic analysis, or pre-sales security engineering. And lots more. With what you have told us, we cannot even point you in a direction of study. As a shot in the dark, you could look at the Security+ certification as a base.

It is sometimes a great idea to ask your boss what they expect you to accomplish within the first 90 days of being in your new position. This goes beyond your job description or your daily duties. By asking this question, you get to know what your boss "really" wants you to do, and you can meet your boss' hidden needs in a direct way. Along with this, you could also ask what security certifications they expect you to achieve and which ones they will help pay for. This will help you know what to study for in a way that meets their needs.


How to make SQL injection in PostgreSQL's tsquery? I think there is SQL injection vulnerability in an application I'm testing. This is seen when I enter malformed parameters into a search form. All exceptions are shown in format:

PHP raised unknown error: pg_query() [http://php.net/function.pg-query]: Query failed: ERROR: syntax error in tsquery: "query" (more details about error - in log file)

So it looks like that PostreSQL's tsquery function is used. After looking into some situations like:

The Fat & Rats:C

--> ERROR: syntax error in tsquery: "the & fat & & & rats:c"

I think plainto_tsquery is used to convert query into tsquery's format.

To what extent might this vulnerability be exploitable? Is it secure to use those PostgreSQL functions without additonal sanitizing?

Looking here which sounds pretty similar to what you're seeing, this isn't straight up SQL injection but rather an injection into the query language used in tsquery.  Also from the examples that may have been in a similar [closed] question, there was some oddness that didn't strike me as being a standard SQL Injection issue.

So not to say that it's not exploitable in some fashion, but that standard SQL Injection techniques are unlikely to produce useful results.


Identifying malicious scripts on a website We currently have a specific situation on our website. We are a portal which serves ads, mostly via google network.

Some of our users have started to complain that they are experiencing popups and redirects. Popup is mostly related to some jackpots or free amazon 1000$ gift cart.

I have tried  to fake geolocaion and IP address myself, but i never had any problems with it.

A lot of users which report this activity, states that they only have issues on our domain.

This issue only happens to users out of our country.
What are the best ways to analyze problems like this. This sounds like some malware or faulty ad campaign, but I must be sure, and I can't reproduce issue to trace it.

We had the same issue some time ago. This probably comes from ads from Google AdSense. Unfortunately Google AdSense if full of malicious ads targeted only for mobile devices and debugging this is nearly impossible.

After months of searching and disabling some 3rd-party networks in AdSense panel, we added device detection on server side based on user agent. Now we're serving ads from AdSense for desktops and custom ads for mobiles - problem disappeared (or at least no one bothers to report it to us).


Use-case for decentralized identifiers (DIDs) with unique identities for each relationship The W3C working group is working on the standardization of Decentralized Identifiers (DIDs). I watched a video presentation about DIDs and the presenter mentioned several times the possibility of generating unique pseudonymous identities for each relationship for better privacy. This is something that is also mentioned in the W3C documents (#1).
However, I fail to understand the use case for one DID per service/usage (e.g. online shopper with direct relationship between customer and seller). This looks like an example of direct trust where there is no need for a consistent global storage like a blockchain. To my understanding, the whole point of having DIDs is to have identities that are shared with multiple other entities.
For one-to-one relationships between a user and a service, won't a simple proof-of-possession token provide the same security guarantees at a fraction of the cost? What are the advantages of using unique DIDs for direct relationships versus storing public keys/identities on both ends?
This question has also been asked (and answered) on the W3C DID WG Issues page.

One answer (which was cross-posted to the W3C DID WG Issues page where this question was also cross-posted): There is always some correlation risk when an individual entity uses the same identifier for themselves, for interactions with multiple other entities, or even for multiple interactions with one other entity. Multiple strategies are used to minimize that risk in the universe of DIDs, but it still exists. It increases when some of the other entities merge, as in the business world, or when a governmental entity takes and combines the records of the other entities, as in some repressive regimes.
If the individual entity mints a new DID, for each interaction with an external entity, or for each external entity they interact with, potentially using multiple DID schemes along the way, that individual is adding another layer (or more) to the correlation mitigation strategies.
It is desirable for everything to be visible, in the universes of some entities. It is desirable for less, down to as close to nothing as possible, to be visible, in the universes of other entities. We cannot make the determination of what is best for all entities, but we can offer a range of options such that each entity can, with some effort, make their own determination -- which may change, as time goes on.
As to "replacing your FAX number", as @ThoriumBR suggests -- sure, you can give each external entity the same FAX number, or you can give each external entity a different FAX number, at (hopefully) minimal if ay additional cost, all of which reach you, as if they were the same number, but without providing the correlation detail discussed above.
Perhaps that helps?


Protecting information in TLS client certificates If I understood correctly, when using TLS with client authentication, the client certificate is transmitted to the server in plain text. The client certificate might include personal information, (like CN=name, or X509v3 Subject Alternative Name: email:name@server.com), which could be used to identify users connecting to sites secured with https.

Is there a way to securely transmit the client certificate to the server when using TLS client authentication, without exposing personal information?

It is possible:

Server and client negotiate SSL without client certificate requirement
Encrypted communications begin
Server sends Hello Request to ask for a renegotiation, this one encrypted
Client willing, another handshake ensues
Server sends a Certificate Request to trigger client certificate authentication
(Encrypted) handshake continues normally, and client certificate is protected by TLS.

I don't know how easily you can convince existing server implementations to do it, but the protocol allows it.  I seem to remember that there are other existing reasons and implementations that trigger a renegotiation immediately after the first (unencrypted) handshake finishes.

Updated to reflect @dave_thompson_085's correction, see also his comment regarding TLS 1.3.