Displaying list of registered users on a website I've just started working for a small company that has a Wordpress website with user accounts. Each user account has a login name, display name, actual name, email, password and the rest.

I dug down and found a page which had a list of all registered users (showing just display names, but no personal information), as well as a total number of registered users.

This raises a big stinking red flag with me, firstly because the company doesn't need it, but it also feels wrong to expose this large amount of data. Yet I can't see anyway for it to be manipulated.

Can anyone tell me if this data can be used to carry out an attack on the website or a specific user?

Thanks

If login names can be guessed or inferred by the display names, then it may allow password guessing attacks to take place.

It is low risk, but if it's not needed for any purpose then it should be removed.


A good privacy policy or pursue encryption for private community? I am planning to create a private web site where people of a very specific target group would keep private stuff.

I am between two major roads for this.

Road 1

-Build a trusting and personal relationship with the members. Above this apply htts sitewide and create a strong privacy agreement.

Road 2

-Implement client side encryption with keys that only the user will know and have the responsibility to maintain.

To give a similar example think of that: Keeping a daily journal on the web. Either i would sent my text already encrypted or i would rely on the privacy of the site.

The two are not mutually exclusive.  You can build a close, trusted community in addition to using cryptography to help support it.  Encryption would also help protect the information against an outside attacker.  You also don't have to have the clients themselves maintain the keys, that isn't very useable, but you can have encryption keys protected with their passwords that are managed by the server to simplify use of the site without sacrificing much in the way of security.


XSS through modifying a UI element value? I send an AJAX request and when the HTML loads back, I retrieve the values of some UI elements at the client side and present them to the user, like so:

var displ="<h1>"+$( "#myslider" ).slider( "values", 0)+</h1>
$("mydiv").append(displ);

Can the value of #myslider or any other element like a select box be changed to a value like <script>...</script> and create a XSS injection?

Short answer: Yes.

Longer answer: Yes, if the <select> already contains an <option> with an XSS payload in (somehow - see below), and also it kind of depends on what the slider() function does. If you take your other example (a select input) then using val() without sanitising the content will cause this issue. Unless slider() sanitises HTML content in some way, it may do the same.

This is a form of DOM-based cross-site scripting.

Working example (with a <select>): https://jsfiddle.net/54bv5t3j/

Tested in Chrome for Mac OS X.

addString();
$("select").change(addString);

function addString() {
    var displ=$("select").val()+"<br/>";
    $("div").append(displ);
}

Where there is one <select> and one <div> on the page.

Practical Exploitation

The other question is when can this practically be exploited by an attacker? To make this practical for an attacker, the value of a select <option> would have to come from an untrusted source, either directly from a user controllable request parameter (including HTTP headers, cookies etc) for reflected XSS, or where the payload is loaded from storage (database etc) for stored XSS.

The example above already has the XSS payload in the page, so it is basically assuming that the untrusted input has already occurred.

Example #1

Here's an example that is entirely DOM-based. JavaScript sets the value of an option to the URL location hash. So if the victim is lured onto a page with an XSS payload after a # in the URL, the XSS can be triggered.

https://jsfiddle.net/tkgos3n0/1/

Example #2

I use a server-side technology (PHP in this case) to create a page with a dynamically generated <option> element from a user-controllable URL parameter. Because I'm a super-clever developer, I know that if the double-quotes can be escaped, the page will be vulnerable to reflected XSS on the <option> element itself, so I make sure I remove double-quotes from the string, thinking that I will be safe.

// User controlled parameter
$value = $_GET("value");
// "Sanitise" the value by removing double-quotes
$sanitised = str_replace('"', '', $value);
// Output to the page
echo "<option value=\"" . $sanitised . "\">Choose Me!</option>";

Because the developer has sanitised double-quotes, this issue cannot be directly exploited. I.e. the attacker can put all kinds of characters inside the option value, but he can't inject things like "> to end the option element and start a new one.

However, due to the DOM-based XSS, the Javascript will still take this string, potentially containing HTML elements, and output it directly onto the page. Of course, the developer should have:

Performed HTML entity encoding on PHP (ref)
Performed HTML and Javascript escaping in the Javascript code (ref)

References are OWASP cheatsheets.


Does Windows Update modify Hosts file? I have Avira installed with Hosts file protection enabled.

I've noticed a pattern where Avira warns me of an attempted modification of the Hosts file (but alas doesn't tell me which process did the attempt), and soon afterwards a Windows Update notification pops up.

Is this normal? Does this mean the attempt to modify the Hosts file came from Windows Update (for some security-related reason, etc)?

The closest subject I've seen on SE is this question, where apparently Windows Defender was involved: Something is changing my hosts file without asking

Consider the following scenario:

  You install Windows 8.
  You change the Hosts file by specifying custom IP-address-to-host-name mappings to prevent users from browsing to
  some websites.
  You run a scan in Microsoft Windows Defender.

  In this scenario, the Hosts file is detected as a
  SettingsModifier:Win32/PossibleHostsFileHijack malware threat by
  Windows Defender.

Reference

So when the host file is being restored by Windows Defender, Avira's host file protection could be detecting the change.


Create additional database in server using sql injection I'm trying to do an sql injection in DVWA with Apache2 and MySQL that would create one more database.
This: 2' union select 1,2' create database kala;#-- does not give me any errors but it also does not create the database.

DVWA security setting is set to low.

First, determine if you can use a 'create' statement in a query like that.


Where to start with security testing? Starting with a QA team that deals mainly with functional requirements testing and has little real security testing experience, what simple practical things should the QA team start doing to start thinking like an attacker?

A couple of examples that I can immediately think of are:

use of special characters in text input fields, e.g. '%$<>|" etc.
attempting to overflow text fields, e.g. aaaaaaaaaaaaaaaaaaaaaaaaaaaa...aaa
edge cases, boundary conditions

I'd recommend to hire someone (or some developer could do that) to educate the QA team using OWASP Top 10 or WASC TC. If you want step-by-step guide how security testing should look like, you can use OWASP Testing Guide, which will give you pretty good picture.


Without SSL, what vantage point does one need to MITM non-SSL'd HTTP? OK, so there are two things here: being able to read the content of the requests and responses, and then being able to modify them. The former may depend on the latter, I'm not sure.

But basically, the question is this: What vantage point would one need in order to carry out an MITM attack? In other words, would an attacker just need to be in range of the unencrypted WLAN over which the target connection is taking place? (Firesheep clearly demonstrates that such a level of access enables one to intercept and read requests, but does it also allow one to modify requests and responses before they reach their destinations?) Would you actually need to have access to the LAN router? Would you need to be an ISP or internet backbone? What level of privileged access is required by an attacker, if any?

To perform a MiTM attack the attacker needs to be able to intercept traffic. Some attacks require intercepting traffic only in one direction while other require intercepting traffic in both directions.

There are three situations in which an attacker can intercept traffic between a source and a destination:

The attacker is on the route between the source and the destination.
This could occur if the source machine connects via the attacker's
access point (e.g. via AP spoofing) or if the attacker owns a
router on the "legitimate" route (e.g. the attacker is an ISP).
The attacker fools the source to think that the attacker's machine is the destination.  Examples of this are DNS spoofing and phishing.
The attacker has invasive access to the physical media connecting one machine on the route to another. This is generally the situation in cable networks which is why the DOCSIS standard includes BPI/SEC to protect communications at the MAC level.
(Edited to add:) The attacker can access packets on the source machine or on the destination machine. An example of this is a Man-in-the-Browser attack.


Relative merits of Yubico OTP vs. OATH-HOTP? What are the pros and cons of using Yubico OTP vs. OATH-HOTP?  They both seem very similar.

Usability

The Yubico AES mode does only work with a yubikey. The device returns a long data structure, that needs to be decrypted.

HOTP returns a 6 or 8 digit code. The algorithm uses a truncation to form the digit code. The digit code is created so that a user is able to read the code and type the code into a keyboard.

Thus: With Yubico AES mode you need to have a device that creates and inputs the one time password, while with HOTP you can always rely on the keyboard.

Sync

The Yubico AES mode increases two counters. A plug counter and a usage counter. This data is encrypted, then the encrypted value is sent for validation. Validation in this case means, that the encrypted value is decrypted and than the server verifies if the sent counters are bigger than the last counters, which the sever saw.

In HOTP mode the OTP value is calculated based on the counter.
The server needs to perform the same operation like the OTP token.
This is why you have this window thing. The token could be pressed without the value being sent to the server. The server knows the last value (counter=n) it saw. But it does not know, how many blank presses were performed on the OTP token. So the server needs to //try// n+1, n+2...

The HOTP token can get "out of sync". The Yubico AES mode can not.

Standards

Yubico AES mode is well documented. But it is only implemented by the Yubikey.
HOTP is standardized in RFC 4226.

Crytpography

Well don't ask me. I suppose that both AES and HMAC-SHA1 are sill strong algorithms...

...now you can decide which aspect is a pro and which one a cons. Usually it boils down to usability and the question if you have a USB port or not.
The yubikey is one of the few hardware tokens, that can be initialized and thus you can keep control over your key material. Use a open source backend lile privacyIDEA to enroll and manage the tokens.


Do Anti-Virus programs scan running processes? If I have malicious software running, and I can see it in the Task Manager, is an AV program expected to scan the processes running and test if they are a virus/malware?

Or, does AV have to:

Detect the program on starting to see if it is a virus.  In other words, a program is dormant, not running, no disk scan has been done by AV.  The program starts AV detects it.
Scan it on disk.
(Original question)  Can AV scan the currently running processes and detect which is a virus?  Is that the same as scanning the memory?

Example, if software on a computer is sending out requests to "bad" sites, and I can see it with something like TCPView, should AV see that without scanning the entire disk to find it?

AV's wont continously scan for running processes as it is an expensive operation. It is better to use WMI for process launch notifications.

As far as in-memory detection is concerned, AVs usually hook most of the system APIs and determine the process beahviour to flag if its malicious. As far detecting sending out requests to bad sites is concerned, that depends on your AV, if it identifies it as malicious url, it will block the request but may not kill the process(unless its a known malicious process in which case it will be detected beforehand).

For example:
If your file downloads another file into a temp directory and executes it, it is considered(flagged) as malicious. (You can create an exe which will download putty.exe and run it from temp and upload it on Virustotal).
When AV is analyzing it , it will find API calls for downloading (WinHttpReadData) and launching process (CreateProcess). AVs create an api chain to determine if the file downloaded is the file being executed and if the process is launched from Temp directory.

Basically, there are many ways of detecting in-memory malicious behaviour.


How to authenticate an Add-In on interprocess communication? We are considering to build a Windows application that is split in 2 parts:

one Windows service
some Add-Ins for Microsoft Office, Microsoft Management Console (MMC) and PowerShell.

Additional info:

The service and the Add-Ins are digitally signed with a
company certificate.
All running on the same machine.
The service runs in a different user account than the Add-Ins.
The Add-Ins may run in various interactive user accounts.

The Add-Ins need to communicate with the Windows service to exchange a secret that is known to the service only, but is needed at the Add-Ins to get access to some sensitive data.
Therefore the Add-In would connect to the service (via e.g. named pipe) and requests that secret on demand.
But we need to avoid that another application/process does the same and gets the secret.
Only those Add-Ins that belong to our application (that are digitally signed with our certificate) may get the secret. In other words, the Add-Ins need some way to authenticate themselves to the service.
So my questions are:

How can an Add-In or a running process authenticate itself to the service while requesting the secret?
Is it possible to use the digital signature (or something else that
is unique to it and to the service) for this?

For an Add-In, it might get more difficult when considering that it is hosted by a process that might be signed with different certificates (e.g. Word.exe, mmc.exe, ...).
We are implementing on the .NET Framework.
Thanks for any kind of help.

Your very design - treating non-sandboxed processes running with the same privileges and owner as yours as untrusted - is incompatible with the Windows security model.
There exist ways to authenticate an application to another via IPC, and even to verify the binary that an application is running from and the signature on that binary. However, there is no way to prevent the following cases which would break your security objective:

a DLL loaded into the add-in / client process has created a hostile thread that can read the process memory, turning the client untrusted.
another process has used debug APIs to modify the client process in memory, turning the client malicious.
another process uses debug APIs to read the secret out of the client process after its retrieval (processes have ACLs which could prevent this, but any process with the same owner can overwrite that ACL).

Note that some of these could be prevented by doing things like checking the loaded DLLs or ACLs of the client process, or checking for open HANDLEs to the client process in other processes. However, these all fall victim to "Time Of Check to Time Of Use" (TOCTOU) attacks, where the attacker can ensure that the check passes (the client looks clean and trustworthy) and then invalidate the check result (inject DLLs, change ACLs, etc.) prior to the use of that check result (the service actually returning the secret).
Additionally, it is of course possible for any privileged (admin / SYSTEM / has SeDebug privilege) process to read the secret right out of your service's address space, without bothering with cooperative IPC mechanisms. Consider that MMC is frequently run as Administrator, implying that the user running it at least has the ability to launch privileged processes.
Leaving aside the privileged process case, though, you can avoid exposing the secret itself (assuming it's stored somewhere that other non-privileged users can't read) by instead having the IPC channel function as a relay for the information. That is, instead of the IPC client saying "Hey service, what's the secret?" and then directly using the secret to get the sensitive data, the IPC client could say "Hey service, what's sensitive data ?" and get the data without ever learning the secret.
Of course, this doesn't prevent that data from being exposed to other processes. Nor does it prevent other processes from taking over the legitimate IPC client and making it request all the sensitive data for them. At the end of the day, if you don't trust the programs that the user is running with the same privileges that they are using to run your process, you are trying to do the impossible. In that scenario - where the user themselves is potentially hostile (since they are presumably choosing to run, or at least enabling the running of, processes that want to steal your secret), there is no way in "full" Windows to prevent the user (or one of their "agents" i.e. processes they run with their full privileges) from learning a secret in one of their own processes.
Now, in fairness, you can make it hard to pull off such attacks. That's what DRM (in the form of media or software license checks) tries to do: it can't put a security boundary between the process and the secret (such as a license key, encrypted media key, or similar), so DRM authors put up what one security researcher described as a "nonsense boundary" instead. If the target process' address space makes no sense, and the process itself is constantly checking its own integrity and the binary is so obfuscated that it's hard to reverse engineer and remove all those checks quickly enough, then it can be quite hard to extract secrets from it. Still possible with time - anybody familiar with the history of DRM will note that most DRM schemes of interest to anybody (and some that were pure curiosities) have been cracked, sometimes very quickly - but maybe getting at least a short time is sufficient?

A few good questions, at this point, are:

What assets are you trying to protect, and how valuable is each one?
Where are the assets stored, and what are the trust boundaries around them?
Who are the attackers, that would want to access the assets? (If the user or any system admin is a potential attacker, you're squarely stuck on the DRM problem).
What are the attackers' privileges (if they're low, such as sandboxed Windows Store apps, then that's not a problem; if they're the same as your own - as seems to be the case - you have a problem)?
What are the practical attack vectors by which the attackers could try to access the assets? Answering this question requires thinking about everything each attacker can do - for example, things like the ReadProcessMemory API or potentially reading secrets right out of the file system or registry if they have enough privileges to satisfy, overwrite, or bypass the ACL - and is the part that is often trickiest for a novice to enumerate, but if you provide the info others can help you (as we've tried to do here).
For each attack vector, how severe is the actual threat (likelihood of successful attack multiplied by damage)?
How severe does a threat need to be before it becomes important to avoid it? In other words, how much risk can you accept?
For each threat that poses too much risk, is there any way to mitigate it?

This process - enumerating the assets, their protections, their attackers, the potential attacks against them, the threat due to each potential attack, and mitigations (if any) for those threats - is called threat modeling, and is very useful.


TestSSLServer Results I ran TestSSLServer.exe (from http://www.bolet.org/TestSSLServer/) against a web server in my organization.  The results seemed self explanatory save for one section I'm not sure how to interpret.  Here are the full results of the scan:

C:\temp>TestSSLServer.exe 1.2.3.4 443
Supported versions:
SSLv2 SSLv3 TLSv1.0
Deflate compression: no
Supported cipher suites (ORDER IS NOT SIGNIFICANT):
  SSLv2
     RC4_128_WITH_MD5
     RC4_128_EXPORT40_WITH_MD5
  SSLv3
     RSA_EXPORT_WITH_RC4_40_MD5
     RSA_WITH_RC4_128_MD5
     RSA_WITH_RC4_128_SHA
     RSA_EXPORT_WITH_DES40_CBC_SHA
     RSA_WITH_DES_CBC_SHA
     RSA_WITH_3DES_EDE_CBC_SHA
     DHE_RSA_EXPORT_WITH_DES40_CBC_SHA
     DHE_RSA_WITH_DES_CBC_SHA
     DHE_RSA_WITH_3DES_EDE_CBC_SHA
     DH_anon_EXPORT_WITH_RC4_40_MD5
     DH_anon_WITH_RC4_128_MD5
     DH_anon_EXPORT_WITH_DES40_CBC_SHA
    DH_anon_WITH_DES_CBC_SHA
     DH_anon_WITH_3DES_EDE_CBC_SHA
     RSA_WITH_AES_128_CBC_SHA
     RSA_WITH_AES_256_CBC_SHA
  (TLSv1.0: idem)
----------------------
Server certificate(s):
  b9f26b0aaa19e8c45ad1571adb9fe818dbbe7fab: CN=CONTOSO, OU=FOR TESTING ONLY,
O=MyOrganization, L=MyTown, S=MyState, C=US
----------------------
Minimal encryption strength:     weak encryption (40-bit)
Achievable encryption strength:  strong encryption (96-bit or more)
BEAST status: protected
CRIME status: protected

Does anybody know what (TLSv1.0:  idem) indicates?  Although TLSv1.0 is listed under "Supported versions", my best guess is that TLSv1.0 may be supported, but the server doesn't provide any ciphers that may be used, effectively rendering TLSv1.0 unsupported.

As Wikipedia says, in its infinite wisdom, "idem" is a Latin word and means "the same":

  Id. (masculine and neuter) and ead. (feminine) (Latin, short for idem and eadem, "the same") are the terms used to denote the previously cited source

In this case, this means that the list of cipher suites for TLS 1.0 is strictly identical to the list for SSL 3.0, so it is not repeated in the tool output.


How to protect ftp account information in the source code of a program I wrote a game which stores high score information on an ftp server.
In the the source code I need to write out the ftp link with the account name and password in it.

For example:

url = new URL("ftp://name:password@www.mywebsite.com/");

This is java, btw. In the class file strings are preserved as they are written in the source code. So if someone were able to read the class file the could find this string, ftp://name:password@www.mywebsite.com/, with the user name and password in plain sight, as plain as slight gets in a class file anyway.

What would be an appropriate way to secure the user name and password?

Edit:

I made an encryption class in java and replaced the name and password with calls to the encrypter with an encrypted user name and password for example:

url = new URL("ftp://Crypter.crypt("q345uih34",3)+:+Crypter.crypt("nfk3iugr29o8",-2)+@www.mywebsite.com/");

Would this be sufficient? And I wasn't sure if obfuscation was the best solutions though.

There are a number of attack vectors in this scenario, so just hiding the password will not help:

any code that you give away to people can be manipulated. This means that an attacker can just set his high score to an arbitrary value
ftp, in the way you use it, is unencrypted, so the complete communication will show up in a network sniffer such as Wireshark
the attacker can just set a breakpoint on the constructor of the URL class (very simple but a bit annoying because there are usually many calls to new URL().
the attacker can decompile the source code and search for "new URL", obfuscating will not help because this method is part of the Java API and therefore cannot be obfuscated. If he cannot understand the source code, he can add debug output or just place the breakpoint at a better place.
the attacker can use byte code enhancing to add a logging message to the constructor of the URL class

So it does not really matter how and where you hide your ftp password.

The only good solution is to have a server which does the highscore calculation itself (and even this way has the issue of bots). You should at least use a protocol that supports encryption (https, sftp, ftps). You need to ensure that someone who learns the credentials cannot destroy the high score data of other users. This can be done by tight permissions that allow only the creation of new files in the ftps/sftp-server or by using a web application that accepts the data and store it itself.


Does your ISP know your router's name? If you named your router "A" then changed it to "B", would they know / be notified

Does your ISP know your router's name

By Name I'm assuming you either mean the name of the WiFi SSID (wireless network name) or the hostname assigned to the router on your LAN.

In either case there is no need for the ISP to know this. There is no reason for either of them to be broadcast to the WAN side of the router.

However many ISP provided routers do gather large amounts of information about your settings. These are usually for diagnostic and usage monitoring purposes. I would imagine that for some ISPs everything the router can "see" can be read remotely - including both of these names. The ISPs argument for why would be for phone support - i.e. you've changed the router name to something different from what is printed on the back of the router and now you're phoning them asking why you can't find your network on your phone.

If you would rather they could not do this use your own custom router / access point.


Network Vulnerability Scanner placement on network We have implemented/are implementing a network vulnerability scanning process, and we have chosen to use Qualysguard.

Qualys supply a scanner appliance for the internal network scanning, which obviously connects to the network. Our internal network is segmented into multiple subnets, each firewalled from the others. We have a network segment which is used for IT management (such as Snort and Splunk). It would seem to make sense to have the scanner appliance in this network segment. The obvious issue is that the scanner appliance needs full visibility into all the devices it will scan on the network, and I'm loathe to open up firewall ports if it can be helped. I know that someone will say that there should be a scanner appliance in each subnet, but that's not practical for us.

I can think of several possible network locations for the scanner appliance:

In the management network
At the most-protected segment of the network (scanning out to less-protected devices)
At the lest-protected segment of the network (scanning in to more protected devices)
In an entirely separate subnet

So my question is that given that the appliance needs full (all ports open) access to all devices, where would you put the scanner appliance on your network and why?

I have not used QualysGuard however using a vendor agnostic approach I would consider the following.

Indirect connection through firewall:

This can be a good option if you are unable to connect to the subnet for some reason (not enough connections, physically not accessible, etc...).

Some types of active scans depend on logical network location and may not work though a firewall / IPS (such a broadcasts and some poisoning) depending on your configuration. This is normally not a problem because the firewall / IPS provides that layer of protection, but an assessment may not be complete.

Increased load / processing through firewall and network equipment. Vulnerability scanning traffic can stress network equipment and may flood links. If this is a concern then locating the scanning interface logically close to the target is an advantage.

Direct connection to subnet:

Generally the best performance way to install a scanner, but can be a problem if you are unable to connect to a switch port with access to the network or VLAN you want to scan.

Directly connecting a scanner where it has direct connectivity to it’s target may allow it to detect vulnerabilities that are masked behind switch, firewall or IPS devices.

Scanners bridges secure zones. A scanner can have vulnerabilities too, less so these days but every scanner interface is potentially a bridge to multiple networks. This obviously depends on your implementation and product, some are better than others. Scanners would not normally route traffic but may if a vulnerability existed in the scanner or the scanner OS.

Conclusion:

The other options you have listed are all valid and could be used with an indirect connection through a firewall. Ideally you need to scan the platforms or applications from the side they will be servicing requests on. That may not be possible on a management network, depending on your configuration.

  Where would you put the scanner appliance on your network and why?

I would connect the scanner with directly connected ports on your most secure subnets (Internal network) which would likely have more hosts to scan. And then put some other interfaces in a separate subnet with access through firewalls to your least secure subnets.

This limits bridging and allows you to scans most/all of your hosts with minimal performance hit.

Hope this helps.


How does malware stay undetected for months? For my college course, I am currently researching how malware works and stays undetected from antivirus and users. I built a proof of concept that stays hidden at scan time and run time.

If a hacker would spread this file, how would he keep it hidden? Avast, AVG, Microsoft, ... have sample submission on by default so I would guess that this file would last not more than a couple of weeks before being detected.

You may refer the virus/malware type called 'Polymorphic Virus'.

A polymorphic virus is a complicated computer virus that affects data types and functions. It is a self-encrypted virus designed to avoid detection by a scanner. Upon infection, the polymorphic virus duplicates itself by creating usable, albeit slightly modified, copies of itself.

Source: https://www.techopedia.com/definition/4055/polymorphic-virus

Trend Micro explains it this way:

Polymorphic viruses are complex file infectors that can create modified versions of itself to avoid detection yet retain the same basic routines after every infection. To vary their physical file makeup during each infection, polymorphic viruses encrypt their codes and use different encryption keys every time.

Source: https://www.trendmicro.com/vinfo/us/security/definition/Polymorphic-virus

You can find some example of such codes here:

http://www.informit.com/articles/article.aspx?p=366890&seqNum=5


A neighbor is using a WEP encrypted router, should I inform them of the security risk? Someone in my neighborhood is using a WEP encrypted wifi router. I am not sure who they are yet, but if I find out, should I inform them of the security risks which that poses or are there any legal ramifications to doing so?

To be honest, I find that most people don't / won't care.

Unless they are running a business or similar functionality over the network I wouldn't bother explaining the difference between WEP and WPA2 to them, especially since they might not be tech savvy and just get more confused or worried about it.

At least they are using SOME security. I have been to many stores where they just plug in their router (Linksys for example) and don't secure it at all. THAT would be something worth bringing up, especially if that's the network they use for their POS system (like a card reader)!

I doubt there is anything illegal about telling someone their security isn't the best. Unless you broke into their system to find that out :P

TL;DR:
If it's a home router for a private network it isn't worth the effort.

EDIT:

I think this might be a good example for something I heard quite a lot in my Net Sec Classes:

Time & Money vs. Risk Factor

In bigger companies these type of decisions have to be made every day, and there are always two groups.

Us, the Security people. Of course in our perspective this Wifi should be made as secure as possible because 'technically' someone could easily breach it and use the internet access to blame any illegal activity on the owner of that network. We should always keep such a 'worst case scenario' in mind.
People like 'Upper Management', or in this case the owner of the WiFi. They probably aren't very involved with Cyber Security and don't care much for it as long as their internet is working.

Our job is to compromise and figure out if it's worth it to 'invest' into this security issue. At a bigger company this investment would mean Time & Money and the required manpower. You might need to take some time to explain and demonstrate the security risk of having a low security protocol to your neighbors. This could range from a quick 5 minute conversation up to 2 hours of you trying to explain networking terms to someone who has not much of an IT background.

One way to find out if this investment is worth it is deciding the Risk Factor.

How likely are your neighbors to be victims of a network breach?

If you live in a crowded place like Manhattan NYC for example, you should most definitely secure your WiFi as much as possible, the risk of someone scanning the area for easy-to-breach targets is higher in such a populated area. If you live in a suburban area, far from downtown, the risk is relatively low.

Now this might seem a bit overkill for such a simple problem, but try to relate it to a company deciding weather or not they need another piece of software which could be thousands of dollars in license fees and hundreds of man-hours for installation & support.


Importing an expired certificate into my jks I'm pretty new to the certificate renewal process, so bear with me if this is a stupid/easy question I'm asking.  I have a jks store that had a certificate expire under the alias aliasA.  Another member of my team renewed the certificate in their jks.  They sent me the jks, and I exported the renewed cert to it's own file.  I'm now trying to import that cert back into my file under the same alias, but I am getting the following error:

keytool error: java.lang.Exception: Public keys in reply and keystore don't match

I don't want to just replace the jks, but I just need to renew that one particular cert.  What does the error mean?

Certificates are nothing but public keys signed by a certificate authority. If it is a server-side certificate you're trying to import, the certificate would need its corresponding private key as well. You probably need to import the contents of the entire jks file shared by your teammate because I assume it has the renewed key also. If you only import the certificate, it might try to match it with the old key and throw the error you are seeing.


Encrypt files on flash drive for easy decryption I am looking to give some files to my accountant, who is not computer-savvy. I am going to put the files on a flash drive encrypted. I assume, accountant has no software other than standard Windows for decryption. I cannot rely on accountant being smart enough to download and install tools like truecrypt or 7-zip. I am also assuming accountant will be reluctant to run self-extracting executable, or at least I hope he is not that careless.

At this time, the best that option that comes to my mind will be to pack the files into a password protected zip file. This will, however divulge the file names, which I also want to hide, so I will have to zip the files twice - once into an non-encrypted archive, and second time into a secure one. I think there is a header encryption in newest zip format, but I could not find free tools that would do it (7-zip doesn't). Also I don't know if Windows is capable of decrypting such archive.

Can anybody think of a better option?

Working at an accounting firm presently, we have that problem of needing to securely transmit files with no expectation of "smarts" by any of the parties involved.

We handle this by establishing (contracting out to a 3rd party) an SSL website that files are uploaded to. The client is sent an email with an authentication code (or we can suspend sending by email and provide the code over the phone, in person, etc). They get one shot to download the file. As soon as that code is used, the system deletes the file.


AWS-S3 Signed URL Security concern When you create a pre-signed URL for your object, you must provide expiration date and time. The pre-signed URLs are valid only for the specified duration.

Anyone who receives the pre-signed URL can then access the object.

We have some security issue here, considering anyone who gets this URL can access the associated resource. Do we have any mechanism where we can embed authorization as part of this presigned URL?

Like, can we add canned ACL headers as part of this URL request, so only granted users\groups can access the resource?

I know this answer is too late but better late than never. You can use signed-url of cloudfront to allow user access to specific objects.

https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/private-content-signed-urls.html


How is Fingerprint Authentication Secure? Lately, biometrics are being used for identity verification everywhere. e-Visas, Passports and even bank transactions (UUIDAI Aadhar system in India is now being used for identity verification, micro-payments, e.t.c.). I still can't understand how it can ever be secure. Here are some ways one could potentially hack the system:

A hacked 'biometric scanning' device can be used by say, a merchant who accepts micro-payments. Usually, the scanner itself encrypts the fingerprint data but the hacked one need not. So, since the merchant has his biometric data, he can authorise the payments as many times as he wants without user's consent.
The usual argument of how the biometric data is immutable unlike resetting text passwords.
Actually, there is no need for a hacked scanner. One could obtain biometric data through fingerprints left literally everywhere a person is. Then fake passports can be forged by creating a smart chip with that data. I'm not sure how smartchips encrypt data. Is a common encryption technique used with different keys for each chip used? So the server stores the public key of this key and checks against it? I've also read that smartchips perform some kind of computing? What is being computed?

How is the authentication systems secured from such attacks?

Biometric is not very secure for authentication, but it can be secure enough for identity verification for many applications when there is a trusted witness when the biometric is taken. Biometric is also useful to detect duplicates. For biometric payment, the trusted witness is essentially the merchant. For identity verification, the trusted witness is usually a government employee. Note that four identity verification, the main problem is detecting duplicates and recording biometric effectively prevents the same person being issued multiple identity cards.

Using fingerprint for payment is a calculated business risk vs convenience trade-off. I don't know about the details of the fingerprint banking you're referring to, but I'd guess that merchants that accepts biometric authentication bears the responsibility of ensuring that their customers don't do weird things (like using false fingers) on the payment machine. If the customer or bank claims that a transaction is unauthorized, the merchant would be considered responsible for unauthorized transaction that is issued using their machine and/or merchant account. Many legitimate merchants considers the risk of abusive reversal to be fairly low when considering the transaction limit and additional business they receive due to offering the option. Merchants that facilitates fraud, either intentionally or by negligence, will have to refund any payment, and will be investigated by the bank's fraud team if they detect abnormal pattern of reversals and may become blacklisted.

Risk and security wise, this is not very different than a hand drawn signature, where merchant is supposed to compare the signature visually with the signature on the back of the card. Fraudulent merchant can use a modified machine to record the card number and signature during transaction.

Smartchips used in bank cards and identity cards are essentially very small, low power computer with a secure computation and a storage area that cannot be read out of the card without destroying the chip. The secure storage contains a private key and a card program running in the chip uses public key cryptography to generate a cryptographic signature of the transactions. The cryptographic signature is a very large number regarding a data that cannot be calculated without the knowledge of the private key and would become invalid if any part of the data is changed. In a chip-only transaction (e.g. PayWave, PayPass), the card signs low value transactions without the user needing to authenticate with the card, in a chip-and-pin transaction, the user must input a pin number matching the pin stored in the card before the card signs the transaction.

Because of the much improved security due to the use of cryptographic signature, transactions involving cryptographic chip usually don't put the liability of unauthorized transaction on the merchant. Instead, it becomes the issuer's and customer's responsibility to keep their card safe.

Chip-and-fingerprint can be implemented as a more convenient alternative to chip-and-pin, while being much more secure than chip-less swipe-and-drawn-signature transaction.

In conclusion, yes, fingerprint is not very secure. But when the more secure alternative like chip-and-pin is considered too inconvenient by the target market which readily switch to cash, it is still a security improvement compared to staying with swipe-and-drawn-signature. Note that banks and merchants don't care about the security of your card, if they can offset having to take the burden of the fraud liability with increased transaction volume and faster payment processing.


HTTPS: is the data downloaded when loading a page encrypted? So as far as I know, when you go to a https enabled website, all the data you send to that server will be encrypted with their public key, and only the server holding the private key will be able to decrypt it.

BUT, what about the data downloaded from the server - incoming traffic? E.g. if someone could intercept incoming traffic from an https-enabled website to my computer, could they see all of the data I am downloading?

An HTTPS connection encompasses both directions; server->client data is encrypted just like client->server data is.

The private key is important in securing the session key setup, and the session key is used by both sides to encrypt the conversation.


using psexec_command to trigger veil payload I have been following various tutorials in an attempt to get a meterpreter session on a lab VM, but I am having some problems triggering the payload.

I created the payload using veil (setup1.exe).

I have an administrator hash that I have been unable to crack, so I used the auxiliary/admin/smb/upload_file module in metasploit and used the hash. This copied the file to the C:\ on the target.

I then used auxiliary/admin/smb/check_dir_file to confirm that the upload was successful and the file (setup1.exe) was found on the target where expected.
Finally I tried to use psexec_command with the command: C:\setup1.exe to trigger the payload.

I had already set up a handler in metasploit to listen for the connection.
psexec_command gives me the following output when I run it:

[*] 192.168.XXX.XX:445    - Executing the command...

[+] 192.168.XXX.XX:445    - Service start timed out, OK if running a command or non-service executable...

[*] 192.168.XXX.XX:445    - checking if the file is unlocked

[*] 192.168.XXX.XX:445    - Unable to get handle: The server responded with error: STATUS_SHARING_VIOLATION (Command=45 WordCount=0)

[-] 192.168.XXX.XX:445    - Command seems to still be executing. Try increasing RETRY and DELAY

[*] 192.168.XXX.XX:445    - Getting the command output...

[*] 192.168.XXX.XX:445    - Command finished with no output

[*] 192.168.XXX.XX:445    - Executing cleanup...

[-] 192.168.XXX.XX:445    - Unable to cleanup \WINDOWS\Temp\pQmXEfWYhTIBaLOJ.txt. Error: The server responded with error: STATUS_SHARING_VIOLATION (Command=6 WordCount=0)

[-] 192.168.XXX.XX:445    - Unable to cleanup. Maybe you'll need to manually remove true, false from the target.

[*] 192.168.XXX.XX:445    - Scanned 1 of 1 hosts (100% complete)

[*] Auxiliary module execution completed

I am still a relative newbie and was hoping someone might be able to give me some pointers?
I don't know if it is just that it is a lab vm, so may be purposefully more locked down than a real-world machine might be?

The payload created in veil (as I was following a tutorial) only used base64 encoding, and I wondered if it could be that the AV was still catching it? Maybe I need to use the obfuscated pyinstaller as well?

Also, does psexec need to be installed on the target for psexec_command to work? I also came across wmic and wondered if that was worth a shot instead?

I am happy to keep doing my research, but if anyone had any pointers it would be much appreciated :-)

I think the problem was that I was using bind_tcp instead of reverse_tcp.

I guess this might not always be the solution depending on other factors like firewall etc? But in this case it worked.

(Also, as a PS - viewing the running processes after exploiting the VM showed all of the other executables running, so I think the problem was the connection back.)


Did Cisco not patch this vulnerability in these modems? I found this article
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/Cisco-SA-20120613-CVE-2012-3047

In here are listed vulnerable products, but the list of products that received fixed software is lot shorter.

Does this mean Cisco did not patch vulnerability in those not listed under Fixed Software? Those devices are considered too old to be updated?

The products that aren't being patched are considered EOL (End of Life) or obsolete. Their entire cable modem line, including all the DPXX models, was sold to Technicolor.

You can find more information here: http://www.cisco.com/c/dam/en_us/about/ac49/ac0/ac1/ac259/docs/connected-devices.pdf


What are the differences between the versions of TLS? Please correct me if I'm wrong, but my understanding is that SSLv3 and TLSv1 is just a rename of the earlier protocol... but TLSv1 adds the ability to have secured and unsecured traffic on the same port.

What are the differences and benefits of all the newer specs of TLS?

I like this blog entry by yaSSL describing the differences:  http://www.yassl.com/yaSSL/Blog/Entries/2010/10/7_Differences_between_SSL_and_TLS_Protocol_Versions.html

I copied the key snippets from the blog to here:

  "SSL 3.0
  [..] Some major improvements of SSL 3.0 over SSL 2.0 are:

  Separation of the transport of data from the message layer
  Use of a full 128 bits of keying material even when using the Export cipher
  Ability of the client and server to send chains of certificates, thus allowing organizations to use certificate hierarchy which is more than two certificates deep.
  Implementing a generalized key exchange protocol, allowing Diffie-Hellman and Fortezza key exchanges as well as non-RSA certificates.
  Allowing for record compression and decompression
  Ability to fall back to SSL 2.0 when a 2.0 client is encountered

  TLS 1.0
  [..] This was an upgrade from SSL 3.0 and the differences were not dramatic, but they are significant enough that SSL 3.0 and TLS 1.0 don't interoperate.  Some of the major differences between SSL 3.0 and TLS 1.0 are:

  Key derivation functions are different
  MACs are different - SSL 3.0 uses a modification of an early HMAC while
  TLS 1.0 uses HMAC.
  The Finished messages are different
  TLS has more alerts
  TLS requires DSS/DH support

  TLS 1.1
  [..] is an update to TLS 1.0.  The major changes are:

  The Implicit Initialization Vector (IV) is replaced with an explicit IV to protect against Cipher block chaining (CBC) attacks.
  Handling of padded errors is changed to use the bad_record_mac alert rather than the decryption_failed alert to protect against CBC attacks.
  IANA registries are defined for protocol parameters
  Premature closes no longer cause a session to be non-resumable.

  TLS 1.2
  [..] Based on TLS 1.1, TLS 1.2 contains improved flexibility. The major differences include:

  The MD5/SHA-1 combination in the pseudorandom function (PRF) was
  replaced with cipher-suite-specified
  PRFs.
  The MD5/SHA-1 combination in the digitally-signed element was replaced
  with a single hash.  Signed elements
  include a field explicitly specifying
  the hash algorithm used.
  There was substantial cleanup to the client's and server's ability to
  specify which hash and signature
  algorithms they will accept.
  Addition of support for authenticated encryption with
  additional data modes.
  TLS Extensions definition and AES Cipher Suites were merged in.
  Tighter checking of EncryptedPreMasterSecret version
  numbers.
  Many of the requirements were tightened
  Verify_data length depends on the cipher suite
  Description of Bleichenbacher/Dlima attack defenses cleaned up.


rainbow table for AES 256 CBC knowing IV, cipher text and plain text I'm in a situation where I know that I have to decrypt a file encrypted using AES 256 CBC and I've the following details:

I know the first 16 bytes block in plain text
I know the IV (static 128 bit IV is being used)
I know the encrypted text
I don't need to know the exact passphrase, it's enough to recover the 256 bit seed derivated from the passphrase

I think the best way to attack this would be generating rainbow tables. Is this approach feasible? What would you suggest in this situation?

Many thanks!

Generating rainbow tables is never the best way to attack a single instance. Rainbow tables are precomputed tables: you do a lot of computations in advance, under the hope that you will be able to apply these computations to several attack instances.

Precomputed tables (rainbow or not rainbow, this does not change anything here) all follow the same pattern:

During precomputations, you "try" N possible passwords and, for each of them, you apply the relevant cryptographic function (in your case, some sort of hash for password-to-key derivation, then symmetric encryption) and store the result (for a rainbow table the storage costs are lowered, but the CPU cost is unchanged -- in fact, it is somewhat enlarged due to the specifics of the rainbow).
At attack time, you look up the observed hash/ciphertext in your table. If the password was indeed one of the N that you processed during the table construction, then the attack works. Otherwise, it does not.

So generating the table costs as much as the worst case of a simple brute force attack: you still pay for hashing all N possible passwords. If you have only one instance to attack, then the direct brute force is cheaper.

In your case, you have some (unspecified) password-to-key derivation scheme h, and what you have to work with is:

    f(p, IV, m) = IV xor AESh(p)(m)

where p is the password, IV is the IV, and m is the first block of the plaintext (the first 16 bytes). If you want to build a precomputed table, then that function f is what you have to evaluate for each password. The resulting table will be applicable only to cases that use the exact same IV and the exact same first block of known plaintext. If either the IV or the known plaintext is different, then not only is the table a poor idea for breaking a single instance, but it also becomes a poor idea in all generality since the table will be usable only once.

A critical point is the h function: the process by which a password is turned into an encryption key. If the h function is a proper password hashing function, the it has a salt, which is generated a new for each password, and this completely defeats precomputed tables, even if the IV and the message are reused exactly.

Even if h is a basic, fast and unsalted hash function (say, a single invocation of SHA-256), then you still cannot reuse existing (rainbow) tables, because you do not have access to the hash output; you only have the ciphertext. The encryption step is sufficient to put your context outside of the contexts for which rainbow tables already exist.

Therefore, if you want to enact your breaking attempts, you will have to implement some brute force mechanism. Roam the Web to gather implementations of AES and of the h function, whatever that hash function is. Put them together in some code that tries potential passwords. Compile, run, be patient.

In any case, such brute force works only insofar as the used password is one of the passwords that you can plausibly try within the limits of your patience. If the AES key is not really derived from a password, but was generated randomly from a cryptographically secure PRNG, then forget it. You won't brute force it.

What you can do depends on the context. For instance, if you have access to a device or system that performs encryption with the key you don't know, but on data that you can choose (a chosen-plaintext attack), then the predictability of the IV (it is always the same, in your description) allows you to perform a brute force on the data (not the key), which, depending on the data, may be very efficient.


How to identify hashes How can I indentify a hash? Not with length only, I mean: as I know, specific hashes has specific charsets. Where can I find them? I need this information for making a hash indentification tool.
(this is an a unique post, the another one wasn't fully answered).

There is a difference between a hash as defined for a specific protocol and a cryptographic hash. A cryptographic hash simply takes a message of x bits and outputs n bits where x can be any positive number or zero and n is the output size of the hash. So in that sense a cryptographic hash doesn't define any encoding. A cryptographic hash is indistinguishable from random to a person that doesn't know the input (apart from the output size). So you cannot distinguish between SHA-256(x) and SHA-512/256(x) without knowing x.

A hash can however be encoded together with various parameters, especially if it is actually a password hash (which actually is a PBKDF or password based key derivation function). In that case it depends on the protocol that generates the hash. This is what sites like the one pointed out by User456 show. These values should only be interpreted for those specific protocols. These protocols however have not been designed from a common specification; the protocols do not have to adhere to any rules. Output of these protocols may very well overlap.

So the only way to say which encoded hash is for a specific protocol is to compare the encoded hash against the format defined by the protocol. Regular expressions could be used to filter out candidates. You should expect a mix of hexadecimals, base 64, decimal numbers and of course separator characters for most of them.


Is it safe for web application to receive and parse emails? I am not sure, if this question needs to be narrowed down to web applications only, but that is my particular interest.

Suppose a web application receives (retrieves from mailbox) emails, parses the content, stores some information in the database and later it is used to prepare some information on the web page.

Does this open up any additional security risks compared to common input fields like the html textarea field where user can enter strings?

Are there any other security precautions if you know that anyone in the world can send anything and it will be retrieved and parsed by your application?

There is no specific problem with email. Processing any kind of external (and thus probably attacker controlled) content  has its risk and not only in the server. For example displaying the email within a web application can result in cross-site scripting, CSRF etc, similar to any other content displayed in the browser.


Protecting hidden form fields The scenario is as follows:

An application has a web interface through which data can be configured.
The data to consider for this question is Users with a many-to-many relationship with Groups.
Each Group has one or more Admin Users.
Multiple Admin Users from different Groups can be logged in at a time.

Consider the following use case:

An Admin User logs into the web interface and chooses to see a list of Users in their Group.
The Admin User selects a User to edit (e.g. change privileges).
The Admin User is redirected to an edit page for a single User with the normal User's ID in a hidden field in the edit page.
The Admin User enters a new privilege in the form and submits the form.
The web application updates the normal User's privileges in the database.
This aspect of the web application does not require performance optimisations, operations on the order of a few seconds is acceptable.

It's naive to believe the normal User's ID can't be edited on the client side thereby allowing the Red Admin User of Red Group to change the privileges of a normal User of Blue Group (of which the Red Admin User is NOT a member).

What can be done on the server side to protect the integrity of the ID of the normal User being edited?

For the purposes of this question, assume that the Red Admin User has been correctly authenticated and is allowed to view the edit page of a normal User of the Red Group. I'm concerned here with the Red Admin User maliciously changing the hidden User ID of a normal User of the Red Group to change the properties of Users of other Groups.

Specifically, this system is developed using Java EE running on a Glassfish server.

I've considered the following solutions:

Embed a cryptographic checksum incorporating the User ID as a hidden field in the edit form. An MD5 hash or similar would be inappropriate as the Red Admin User would just need to calculate the new hash. The hash would need to be derived from some server-side secret. Obviously the secret would need to be unpredictable and protected.
Currently the system uses a stateless session bean to carry the ID of the normal User to be edited from the list of Red Group Users to the User edit page. I could change the session bean to be a stateful bean would would maintain the User ID to be edited within the server but I'm considering other alternatives.

What other options should I consider to combat this particular threat? Subjects such as user authentication and secure transmission are outside the scope of this question.

I think you're working on the wrong end. The server simply needs to check if the admin is authorized to edit the user right before the update. Whether or not the admin has altered the form is irrelevant and cannot really be checked, anyway. The point is that you only accept changes if the user is authorized to do them – just like everywhere else in your application.

Trying to protect the parameters is missing the point. It's also very difficult and will lead to all kinds of problems. For example, let's say an admin of group Red starts to edit user A who is indeed a member of this group at this point in time. The admin doesn't touch the form at all, but he does wait. In the meantime, user A has switched to group Blue, so the admin shouldn't be able to edit this user. However, you would probably let them do it based on the obvervation that the form hasn't been altered.


What registry windows keys malwares target often? I wonder what are the main registry windows keys malware target often ?
I would love to code a program that will check the state of those windows registry keys for eventual modifications by malware.

The most common?  Probably HKLM\Software\Microsoft\Windows\CurrentVersion\Run -- it's how programs arrange to be run at startup.  Of course, a lot of perfectly harmless programs also use it, so watching it won't gain you much.

The problem with simply watching registry keys for modification is that normal programs also change many of them.  You can't, for example, tell the difference between a spyware toolbar installing itself and an ordinary toolbar being installed just by watching Internet Explorer's section of the registry.


Can employer see ssl content on wifi Doing research, I haven't found anything specific to my question. I work for a small local company with 15 employees. I originally hooked up the internet but we hired an I.T. Company recently. We have a Sophos firewall, hooked to an hp switch. The wifi router is connected to the switch. The I.T. Company put a "file sharing" computer on the switch and I know they said there is computer performance monitoring on that computer. They have a VNC, and agent and all that on the computers for monitoring.

My question is wifi. The log-in is generic, not per-person. Just need the wifi password. So if I connect my phone to work wifi and am using an app that defaults to ssl such as Tumblr for example. I'm curious as to if they can see the content? I do not care if they can see that I opened the tumblr app, but can they see WHAT I was looking at or searching. I know the firewall does not have any filtering or monitoring turned on because I can access it, but I don't know what they have on the computer they hooked up. And my phone does not have any company certs installed on it.

In general no, without certs installed on the user's computer, SSL traffic won't be visible.

They could play tricks with non-SSL connections, but if the app successfully creates the SSL tunnel, it should be safe.


Where do malware typically hide in a Windows machine? Where can typical malware hide in a Windows machine? If not ran as an administrator, can they only hide in places where the UAC will not be triggered?

Malware generally hides in folders that will be present across multiple machines, e.g. C:\Windows or C:\Program Files. Where it is able to hide depends on the program that initially placed the malware, and the permissions that it has.


Found security vulnerability, what should I do? Possible Duplicate:
  How to disclose a security vulnerability in an ethical fashion?
  Reporting vulnerable sites

I've found a security vulnerability which gives me the ability transfer money to my account.

What should I do now? Do I get payed by the company where I found the bug? Should I report that bug to them before they tell me how much they pay me for that bug or after?

Should I write to the Customer care or the Sales mail address of them? And what should I tell them anyway?

Am I allowed to share the existence of that bug without providing details?

The problem is that I'm a minor so I don't know anything about all this and I've also the fear that they don't believe me because of my age.

What I ended up doing:
I just sent them a mail with the bug and didn't tell any adult about this at the time. The fixed the bug pretty fast and gave me a really small bounty worth around $200 at that time.

What I would do today:
Now that I'm not a minor anymore (ohh my I've gotten old). I'd contact them through a penetration testing company or something similar and ask them if they'd be interested in us checking their system. Telling them that they wouldn't have to pay anything if we wouldn't find anything and disclose the bug through that. If they refuse, they usually don't if done right, I'd get in touch with them anonymously and disclose the bug.

It is unlikely that you can legally make money from this bug.  If you are considering some scheme to make lots of money from it: step away, take some time off.  There is a significant risk that you will be prosecuted for hacking or for extortion if you try to demand compensation for reporting the vulnerability.

Note that in the US, hacking is illegal.  The law is extremely broad and prohibits all sorts of things that many people might not realize are illegal.  I don't know how you discovered the bug, but I am worried there is a high risk that the actions you've taken up to now (e.g., to discover the bug) might be illegal.  If your actions in discovering the bug violated the law, even arguably, and if you piss off the company or generally act like a jerk (e.g., by demanding compensation), they might call up a federal prosecutor and convince the prosecutor to charge you for violating federal law.  You really don't want to be in that position.

In general, it is rare for companies to compensate people who report security bugs to them.  A few companies (e.g., Google) have "bug bounties" programs, where they promise to pay a few hundred or thousand dollars to people who report serious bugs to them under their program.  But most companies don't do anything like that.

Generally speaking, here is my advice:

Have you ever hacked, or tried to hack, this site?  Did you try anything that could be characterized as unauthorized access or an attempt to attack the site?  (e.g., typing in a single quote to see if it is vulnerable to SQL injection, sending < to see if is vulnerable to XSS, etc.)  If yes, stop here.  Don't disclose the vulnerability to them yourself.  Give up any thoughts of making money.  If you want to do the morally right thing, you could contact an adult you trust and ask them to report the vulnerability on your behalf without disclosing your identity -- but don't expect any payment.
If you are confident you have never done anything that could be characterized as attempting to gain unauthorized access or otherwise attack the site, and you are confident nothing you've done is likely to be treated as a violation of federal law (e.g., CFAA), then you could consider how to report the vulnerability to the site, if you wish.  But don't expect to make any money off this.  Don't demand compensation.  Don't threaten.  Don't ask for compensation as a condition of disclosing the bug.  Don't expect compensation.  If you are doing it in hopes of making money, stop: set it aside, because you don't want to be accused of extortion, and you have a lot more to lose than to gain.

If you want to disclose the vulnerability, I would try to find someone you trust who has worked in a professional business context for many years.  Ask them to help you disclose the vulnerability.  Ask them to help you write a letter or email that describes the vulnerability.  (I would disclose the vulnerability in writing, e.g., an email, a written letter, not by phone or in person.)  Also, before doing any of this, have them read this thread and the following threads on this site:

Reporting vulnerable sites
How to disclose a security vulnerability in an ethical fashion?
How should I escalate a vulnerability that is dismissed by the vendor?
Which companies facilitate payment in return for vulnerability disclosure?  (but I doubt they will pay for a vulnerability in a website; there are few or no buyers for that)

The reason I suggest having someone else help you disclose this is because there is a significant opportunity for misunderstanding.  You want someone who has worked in business to help you craft the letter, to make sure it is taken seriously, and to make sure the company doesn't treat you as a threat and start coming after you with threats of a lawsuit or prosecution.  Big companies have entire legal departments full of lawyers who exist solely to protect the company's financial interests.  If they perceive you as a threat, they may use every legal resource they have to try to prevent you from embarrassing the company.  Someone with more experience in a business context can help you protect yourself.

But, the bottom line is: check your motives.  The only reason to report the vulnerability to the company is because "it is the right thing to do" and for the good of others.  You are not likely to make money off this, I'm afraid to say this.  If you find that you are doing this for purposes of making money, stop; go do something else.  If you are doing this for purposes of making money, the risks are too high that you will find yourself hit with a lawsuit, a criminal prosecution, or something else that not only prevents you from making money, but also makes your life hell.  There have been too many other cases where security researchers were prosecuted for "hacking", when they were just trying to report or publicize a security vulnerability (not even try to exploit it for financial gain).

P.S. Here is Dan Kaminsky's informal, not-to-be-taken-too-seriously, summary of how things tend to work today:


How to secure my ajax call to the backend? In my website I'm using an ajax call to get some information from the backend. Even if I'm using SSL someone can intercept the call and replace the real response with a fake one.
Is there a way to be sure that nobody changed the content of the response?

I think you are trying to solve the wrong problem. The main issues with Ajax requests is not the integrity of data, but XSS(cross site scripting), CSRF (cross site request forgery), and authentication bypass.

If you are properly using SSL (not accepting self signed certificates, invalid certificates, and so), you can be sure that nobody can intercept and modify the data. Nobody can, except the government.

You must be sure that Ajax requests obey the authentication framework you have in place. So, try to access it directly without the frontend, save sessions and try to replay them, and catalog all the answers. You must be sure that invalid or unexpected input don't show undesirable data to the attacker.

You must be sure that all user supplied data is properly sanitized before being processed or echoed back. Failure to sanitize data can lead to XSS, SQL injections, local and remote file inclusion, and a host of other problems.

And must be sure that every request is protected against cross site requests, by implementing anti-CSRF tags. Ignoring it can expose your users to some problems, like account takeover, fraudulent requests, and so.

SSL infrastructure is very good, but all the layers above it are much more problematic. People writing SSL software are hardened professionals, but you can find lots and lots of inexperienced developers writing PHP, SQL and Javascript code those days.


Do on-demand SSL certificates exist? A few days ago, I visited an SSL protected website.

Since Safari complained about the SSL-certificate, I did a short inspection:

  The certificate was issued by GoDaddy in just the minute I visited the
  site.

While this might have been a matter of chance, I don't believe.

Therefore, do CAs exist, which issue SSL certificated on demand? I mean, each time a user loads the first URL of a site?

Never heard of such a CA. And can't believe, that a CA can even generate SSL certificates in such a high frequency.

In this context, my other question might be of interest.

There is nothing technologically hard in issuing certificates. It is just a bit of encoding, and a signature; a basic PC can do that a thousand times per second. While CA don't normally indulge in on-demand certificate issuing, there is no inescapable technical barrier to it.

The most plausible explanation is that you are currently connecting through a proxy which does a man-in-the-middle "attack" and really generates a fake certificate on demand. Not a real attack in the sense of some fraudster trying to pick on you; more an "institutional" attack by the local sysadmin, running a product like that one. This is becoming popular in corporative environments.

To check whether this occurs, a simple trick is to change your system date. Indeed, one conundrum of MitM proxies is that they must generate a certificate which will be accepted by the client, which, in particular, implies that the certificate must be such that the current time, as believed to be by the client, falls within the validity range. An often overlooked property of SSL is that both client and server tell to each other their own notion of the current time, in the early stages of the handshake procedure. This allows the server to know how the client's clock is set. If you change your current date and time to, say, last week, and the server's certificate follows that change (close all browser windows and restart it to ensure that a new SSL session is used), then the server's certificate was definitely produced on demand, because there is no other way that certificate would adjust to a wildly off client clock.

You will also want to see to what trust anchor (aka "root certificate") the server chain goes up. If an institutional MitM is in force on your system, then the chain will go up to a corresponding "rogue" root CA. What should happen with GoDaddy's certificates is described here (of course, the MitM may theoretically alter that page as well, as you see it; but if there is a discrepancy between what GoDaddy states and what you observe then it is proven that there is some ongoing foul play).


How to prevent users sharing WPA RADIUS keys? My office LAN does not have a Windows Active Directory.

The Wifi use WPA with a pre-shared key, which means that everyone in the world knows what the key is.

I was thinking of implementing a RADIUS server and switching to that. The question is, what stops a user from sharing his key with everyone else? I looked at Windows NPS and FreeRadius. Don't see any way to restrict a key to one or two devices only.

What do hotels use? You know, where you get a Wifi key for your room which allows only 2/3 devices to connect and is valid for a limited number of days. It shows a web page to enter the key the first time you connect to the Wifi. Could something like that be good for a small office?

If the devices are not owned by the company you cant avoid key sharing. Restricting to X devices is usually done with MAC checks which can be bypassed.

If the devices are owned by the company, you can use authentication that uses hardware methods (for example a TPM), or software methods


Can free Wi-Fi hotspot providers snoop on HTTPS communications? Every article (and post on this website) I find on public Wi-Fi safety is mostly concerned with other people connected to the same network snooping on our communications. As far as I understand it, we’re mostly secure as long as we’re connecting through HTTPS. “Mostly” because there could be flaws in the encryption software or the bad actor could redirect us to a fake page.

But what about the provider? I sometimes connect to free Wi-Fi hotspots (bus, hospital) that require me to accept an agreement before connecting. Sometimes that agreement says they can monitor my communications.

So, assuming I connect to such a Wi-Fi network and only do HTTPS-related connections, could they:

Snoop on those communications in any way.

If not, what can they actually know (I assume just know the host I’m connecting to, but not the content of the communication).

Do some trickery like intercepting the HTTPS request, send it to the server as me, get the response and send it back to me.
Other.

Generally speaking†, one cannot intercept HTTPS communications.

However, a hot-spot provider can do the following:

See the hostnames you want to connect to from your DNS requests
See the IP addresses you connect to
If you type in say http://yourbank.com, hoping for a redirect to https://yourbank.com, the hot-spot owner can intercept that and redirect you or serve you their own content. This is one reason why HSTS exists. If the site uses HSTS or you type in https://yourbank.com or you use a VPN you are fine.

† With the following assumptions:

the site gets a reasonable score on https://www.ssllabs.com/ssltest/
the browser gets a reasonable score on https://www.ssllabs.com/ssltest/viewMyClient.html
the user doesn't override cert warnings


Can registration forms be used for an XSS attack? In most websites that have account logins, there are at least two fields:

Email
Password

Could either of these fields be used to mount an XSS attack (assuming no character encoding)?

For example, could this be submitted in the email field of a registration form:

<script src="www.example.com/mymaliciousscript.js"></script>newuser@stackexchange.com

Anything originating from the client can be used for XSS: form fields (including hidden ones), query parameters, even cookies, User-Agent string, and HTTP headers.

Any field, no matter which one, printed back without sanitization is a potential vector for XSS.


Is using a VPN or Proxy the only explanation for a wrong location being displayed? My boyfriend is using an iPhone XS Max. He is in Johor, Malaysia, but his last active session displays that he is in Kuala Lumpur. He told me that he is in Johor, and he said the only reason why it's displaying a wrong location is due to it possibly using a VPN or Proxy. Is this true? Or are there other reasons why it could show a wrong location?

Yes, it is possible that the location reported is wrong.

How does an IP show location?

The binding between IP addresses and physical locations is very, very loose. The way they work is by seeing which ISPs give out which IPs, and where those ISPs are located. Depending on how wide of an area that ISP serves, and how consistent they are with their IPs being allocated, the better or worse your accuracy is.

Imagine that there was an ISP which would only serve New York City, and they would give out IPs in the block 200.0.0.0/7 (meaning anything from 200.0.0.0 to 201.255.255.255 would be valid). Any IP assigned in this range, e.g. 200.103.10.5 would thus likely be in New York City. Somewhere.

Now imagine a second ISP would serve all of the US, and would just assign IPs to customers from anywhere in their IP address range (let's say 100.0.0.0/3, from 100.0.0.0 to 131.255.255.255). A device with the IP 104.140.92.6 would likely be somewhere in the US. Where exactly? That's impossible to say from this information alone.

What causes inaccuracies?

The data which IP corresponds to which ISP or location is not from any official source. It's being collected and corrected by whoever has an interest in keeping such a database. This means that naturally, there are some holes in the database.

IP address ranges are being bought and sold, causing this data to become outdated. Data can be added wrong, too specific or too loose. ISPs could give out public IPs to which they don't have the rights, although this should not happen.

What does this mean for me?

In general, nothing. Given that Johor and Kuala Lumpur are relatively close together, and that Kuala Lumpur is the larger of those cities, that the ISP your boyfriend is connecting to has its head office in Kuala Lumpur, thus the connection being displayed as coming from there.

On a more personal level, unless you have a specific reason to assume your boyfriend would lie to you, I see no reason to be suspicious. If you indeed assume this, then I highly recommend you to have a look at Interpersonal Stack Exchange to find a way to rebuild the trust between you and your boyfriend.


SSL/TLS compression attacks on mail servers (smtp) Currently, we know few compression attacks on the SSL/TLS protocol (such as Crime or Breach). I wonder for few days if these attacks are practicable on a mail server (smtp). Is CRIME attack practicable on a mail server ?

Compression attacks like CRIME and BREACH work by triggering repeated transmission of almost the same message with only slight modifications, with these modifications controlled by the attacker. By watching the compressed size of the message the attacker can then reason if the attacker controlled string is contained in the message or not. This is used to guess the value of sensitive data, like the session cookie or CSRF tokens in case of HTTP.

With HTTP these attacks work against cases where the response from the server reflects input from the client (to guess CSRF token in response) or by making the client submit the same request with slight variants of the URL or body data to guess the cookie in the HTTP request. Attacker controlled input is possible since HTTP allows cross-site requests, i.e. the attacker can cause the client to do a specific request and then watch the encrypted request and response.

But SMTP works different. There is usually no way for the attacker to make the client send a specific mail again and again with only slight and attacker controlled modifications. Although one might construct scenarios where almost the same mail gets sent in an automatic way with some attacker controlled input in (see answer from @Giles) in my opinion in all practically relevant cases such compression attacks will not work with SMTP.

Still, it is better to not use TLS level compression (used by CRIME) which is hopefully the default in modern crypto libraries anyway. As for the application level compression used by BREACH: while it is common to use such compression in HTTP (declared by Content-Encoding header) there is no application level compression defined in SMTP or MIME (which is the encapsulation format for mails). While there is an proposed x-gzip64 I've never seen it used in practice or supported by actual mail clients.


Effect of Script tag inside HTML comment I recently participated in a CTF and solution of that CTF is based on this weird behavior of browser.
In First case when I am including script tag inside an HTML comment and without closing that comment then the browser(Firefox) assumes whole content after that as comment including body part. And no alert is popped.
Code:

Hello

Browser:

In Second all code is same except I removed script tag from comment now browser ending comment at that position and all other code executed smoothly. Both alert popped 1,2
Code:

Hello

Browser:

So I have two questions.

In first case when browser is assuming code in next lines as comment why even alert(1) is not popped?
Second why browser having different boundaries of HTML comment based on script Tag?

Please answer them or point to any resources. And feel free to modify question, I am new to this field and might have added some rubbish.

An interesting situation indeed. First of all, it must be noted that we cannot nest <script> tags.
In the first case

alert(1);
<!--<script
alert(2);
</script>
<body>Hello</body>

the <script has > missing. Even with that it won't work. However, if we replace it with </script>, alert(1) runs.
The second case is the same as this with alert(2) included within the <script> tags.


What is the function call for escaping `php` in php So I'm working on a boot to root and I think I may have found a section that I can inject php. The problem is when I inject my php it gets commented out. I'm trying to find what function this is so I can see if there's a work around but for the life of me I can't find it because these terms are so ambiguous.

Does anyone know the php function that will take:

<?php echo 'it works'; ?>

and turn it into

<-- ?php echo 'it works'; ?-->

I'm fairly certain that there is no php standard library function that does that. So it's probably some kind of home brew. Off course, it's impossible to say exactly what the function looks like without access to the source code or extensive testing, but one simple guess would be something like this:

$halfway = str_replace('<', '<-- ', $input);
$result = str_replace('>', '-->', $halfway);

But there is an unlimited number of possibilities here. Your best bet is to play around with it and see if something unexpected happends.

Another tip for bypassing this... I found this little note in the changelog for PHP 7.0.0 in the PHP manual:

  The ASP tags <%, %>, <%=, and the script tag <script language="php"> are removed from PHP.

So if you are running PHP below 7 you could try those. Or just a simple <?=.


Why not write the CSRF Token into the Session I am currently developing a web page and came across the OWASP Cheat sheet about double submit cookies. I am now thinking that's a good idea but I didn't get why you are not storing the CSRF token into a session variable of the logged in user and display it on a page in a hidden field. If you submit a form now the server compares the session variable and the form field. If they match you are good to go.

What are the drawbacks of this idea? Why should you place the token into a own cookie which could be stolen? Aren't you minimizing your attacking surface if you store it server side?

why you are not storing the CSRF token into a session variable of the logged in user and display it on a page in a hidden field

This is a proper and commonly used solution to prevent CSRF. Store a random token in the session and compare it on every post. This is described on the linked page, starting with:

  The synchronizer token pattern requires the generation of random "challenge" tokens that are associated with the user's current session.


Is authentication + authorization a good idea at gateway level when using microservices? I have this simple design:

                   ---------               -------------
----> Queries ----> Gateway ---- RPC ----> Microservices
                   ---------               -------------

I am thinking of having the gateway handle authentication and authorization leaving my microservices to completely trust the gateway (aka if the gateway says user x should be deleted, don't double check that auth token, just do it). The microservices will not be exposed to the world and they will establish a secure connection (VPN maybe) to the Gateway.

Is this a good idea? Or should I take the more streamline solution and check the auth token with each request both on the gateway AND the microsevice? What can go wrong?

How are your microservices locked down?

If an attacker is internal or finds a weakness somewhere else within your organization and attacks your microservices are they completely segergated so only requests come through the gateway?

Do any of your microservices perform any actions that are considered more privelged that the rest? Example several services generate page content while another processed payments?

My view is you should be passing an auth token to all your services after authenticating at your gateway but this is going depend on your system threat model.


Backup media storage strategy As a company we are performing daily backups onto RDX removable media which is fully encrypted (shows as unformatted drive) and the backup software also encrypts the files during the backup process, both encryptions are 256bit and different passwords. One of two directors stores the RDX removable media at their home in a fireproof safe. The RDX media is switched before going home each day and then transported in the director’s company/personal vehicle.

The problem we are facing is a compliance issue, some of our existing customers and potential new customers have flagged our procedure as inappropriate and I have now been asked by the directors to look at tweaking our existing system or finding an alternative.
Here’s what I have been considering as tweaks to our existing stagey…

Audit and chain of custody: We have the resources and skill to create an audit for pickup, transport and delivery and I was also thinking of adding GPS tracking too.

Outsourcing to external company: This would certainly give an audit trail and chain of custody with secure location, but the cost of £480 per month is something we would like to avoid.

Here’s what I’ve been considering as alternates…

NAS backup to a fireproof/waterproof device: I have issues with this as it doesn’t sit well in a business continuity plan as compliance requires an alternative location.

Cloud backup: I want to avoid this and will only go with this if it’s the last option.
The problem is that the customers flagging our procedure as inappropriate have been non-specific so some initial feedback regarding our process would be helpful, plus alternatives and tweaking suggestions.

Thank you.

You can probably negotiate with your bank to allow you to use night deposit bags for drive storage. Pad it so the drive can cope with shocks from lots of coins. You can arrange so they won't open your bags. During the day, somebody can move the backup disk in a safety deposit box.

That said, with the data encrypted, your current solution isn't necessarily a bad one. You have reasonable controls to prevent loss of the data by means of encryption.


What Mechanisms Keep Network Processes (and Applications) Sandboxed This question stems from my other question, sorry if it is too similar. Now I would like to know what mechanism is used to sandbox network processes and (if relevant) individual programs, if at all?

Obviously, if the local machine is comporomised and someone has a screensharing program or keylogger installed, all bets are off. I also now that the processor is sandboxed into protection rings, and network information is seperated at some layer of the protocol stack, probably somewhere in the IP/TCP/Session/Application layers along with their unique port numbers used for identification. (Additional clarification on my two previous vague points about rings and layers with relation to my question would be informative).

Scenario: You are doing banking on your web browser with outgoing Port 80 and random uncommon incoming ports. I open a legitimate local Java program which accesses information on the internet on a different port. What kind of crosstalk may be possible? (If language matters, i.e. something other than Java, please explain).

As in my other question, I am not talking about actively malicous software. More like, what is possible for the Java program or Web browser to detect about each other in a normal environment.  Obviously, it would be considered malicious for either program to obtain and send information about the network process without the user's permission... but how far out can each process reach?

Analogy For Asking: Original hubs worked by transmitting information on all ports to all clients which posed a significant LAN concern. All a NIC adapter had to do to listen was to not discard frames not destined for itself. However, this was considered to be normal operation. Is there some reason I should not run banking and other external Java programs simultaneously? If the machine is comporomised completely, then obviously this makes no difference. But I am asking... well I hope you know by now.

CLARIFICATION: My question generally deals with programs which are creating sockets and such. Obviously, all of these programs share a common foundation, the CPU and memory, but programs that do not open ports, or are blocked by the software firewall by default, do not concern me as much. Or should they?

What you are talking about deals with a few different layers of the OSI model:

At layer 7 (Application) you have your web-app starting to communicate with the bank's host (as an example). It initiates a request for communications that is handled by Layer 5 (Session) that creates and maintains the communications channel between the applications. The result is called a socket in common terms. All of the transported data is handled by layer 4 (Transport) which in turn is directed by Layer 3 (Network) which guides the ethernet frame/IP Packet to it's destination, all of which flows through layer 2 (DataLink) which is responsible for handling the modification of the frames for transport onto Layer 1 (physical) the wire or wireless communication.

Layer 6 (presentation) converts or modifies the data being sent, so that it can be understood at both ends by the applications using the data.

Each application running, that requires network communications, goes through that sort of process, and information from each socket is given to the application that opened it. As for most non-malicious programs, they (probably) do not obtain or view information sent to you on other sockets. So, to answer your question, generally there is no reason to not run multiple applications simultaneously. Java-based apps still use their own sockets, and the OS handles which information goes where.

However, since ALL of your information goes through a common layer 2 and layer 1 section, (NIC / Wire / Radio), it is possible to craft applications that can capture and record ALL NETWORK TRAFFIC locally on your machine. (In fact many exist, take Wireshark for example) Since that is the case, it is very possible for some applications to view or take actions based on that captured data. There are a few other attacks that can be used to hijack the session(socket), and obtain the information at that level as well.

What can be done to secure it?
Encryption of the data at different layers can prevent capture of readable or usable data by programs that might want to "peek" at your information. But that is a much different monster and comes with it's own fun bits.

I'm relatively new to the whole networking thing, but understanding the OSI model and how it conceptualizes networking goes a LONG LONG way towards understanding it.


nmap SYN scan taking forever I read on a book that the SYN scan in nmap is usually a lot faster than the TCP connect scan, because it doesn't go through all the three way handshake connection. But when i try both scans on the same target, the TCP connect scan takes 2 seconds, while the SYN scan takes 7 minutes at least.

Can anyone tell me what's wrong here ?

While the SYN scan method itself is theoretically quicker, it doesn't mean that it will always be the best or fastest scan to use. It is possible that a firewall or IPS has detected the scan and is slowing you down (nearly every NIDS in the world knows about SYN  scans and will alert on sight).

You can also try adjusting the timing settings (-T[0-5], higher is faster/more aggressive).

In short, there is no one scan mode or setting that will always be fastest, and you should experiment to find what works best for the target.


Browser doesn't recognize HTTPS I am having a strange issue reported from a client:

This browser doesn't show HTTPS secured and accredited connection, although my site has HTTPS. Normally, on other browsers they show.

For example:

[Company Security Certificate] www.blahblahblah

I don't know which browser this is. I have tried to reproduce with all the latest versions of the following:

Edge
IE11
Chrome
Firefox Quantum
Firefox Developer Edition
Opera
SeaMonkey

However, all of them show HTTPS. This browser looks like a Windows platform because it has Windows outlook, so I can cross Safari off of the list.

Does anyone have a slight chance to recognize this browser or offer any explanation?

Have them go to an https url. So make sure they aren't just going to www.yoursite.com, but click the link https://www.yoursite.com:443

If that doesn't show, try disabling http or closing port 80 on your server in an effort to trouble shoot and confirm it actually https. Have them use wireshark to take a capture and look for tls handshake. If that doesn't work there is a likelihood that your customer has been Man in the Middle attacked with something called ssl stripping. That would be very bad news.

This could be the signs of a cyber attack, so I recommend investigating quickly.


How good is EMET at protecting Windows and should I enable it for every application? I've just found about the Enhanced Mitigation Experience Toolkit. The science behind it is beyond me, but how much protection over an antivirus does it provide?

Should I enable its protection for every process or select the most used attack vectors and safeguard only those? I am concerned about the negative performance impact.

EMET implements various protection features which are lacking from Windows editions prior to Win10. It additionally adds some protection features which catch out common cut-and-paste shellcode. EMET is being deprecated because Microsoft has now rolled most of the features into Windows 10 natively, although not all of them are present.

I wrote an answer a while back which describes some of the standard EMET features.

The performance impact is negligible, even on more complex applications like Firefox, Chrome, Office, and Visual Studio. The only issue I've ever run into is false detection of the "Caller" or "Caller+" features when opening standard dialogs (e.g. load / save) from some applications. For those cases I just turn those features off.

I have enabled EMET against pretty much everything on my system which is likely to be opening lots of untrusted content. Browsers and document readers are the obvious primary choice, video and audio players (e.g. VLC, MPC-HC) too, as well as communications apps (IRC, Telegram), plus Windows Explorer, cmd.exe, PuTTY, image editing suites, and a bunch of other random applications. These all run fine, although some needed a little policy tweaking.

Keep in mind that EMET does not protect you from malware. It implements features which make it harder for someone to successfully achieve a code execution exploit against a vulnerability in the software running on your system (not including the kernel!). These features also help stop generic shellcode from executing properly, so an attacker would likely have to tailor an exploit payload specifically for an EMET-protected system.


What are the biggest security concerns on PXE? What are the top security concerns when setting up a PXE (Preboot Execution Environment) booting environment, ordered by severity of a possible exploitation?

Things that I thought of are (in no particular order):

Rogue DHCP takeover
Man-in-the-Middle attacks on the NBP load over TFTP

The question is meant to look at the general protocol and its possible weak points and is not restricted to a certain setup concerning equipment or attacker.

If anyone wants to help me bring this question in a more suited format, you are welcome.

In a PXE environment, as a pentester, I have 2 major classes of attack I can choose from.

1: I can capture a full machine image. Do your systems automatically connect to the domain controller after setting up the machine? If so, this image probably has domain controller credentials on it, that I can capture and use elsewhere.

2: I can manipulate images on a restored machine. After capturing, I can make an image that has, say, the corporate image with AV disabled and malware pre-installed, then MITM someone's system for a persistent foothold in the company. Since PXE isn't encrypted or authenticated in any way, this is trivial to do with physical access, a few seconds of privacy, and something like a pwn plug or a raspberry pi.