Were software "CD key" schemes backdoored or simply misdesigned? Back in the day, retail software was shipped on physical CDs that often had a printed "CD key" label affixed. The (usually alphanumeric) key on the label was unique to that particular copy of the product, and it needed to be entered during setup for the software to work. The keys had a special property that allowed the installer to determine if the key was valid without contacting a central server of any kind, while still being generally impossible to mash random letters on the keyboard and produce a valid key.

Without giving specifically identifiable examples, there are a number of legacy software products and games that I've seen folks discussing installing in recent months, often with missing/lost keys, and common advice is to use keys that look like AAAA-AAAA-AAAA-AAAA or buttheadbutthead during the key entry dialog in the original, pristine installer -- and somehow these keys generally work. Compared to real keys (which looked random, like BWHP-PWJU-VTV1-94M5) these keys are obviously weak and, perhaps most importantly, very easy to memorize.

It got me wondering why such keys are accepted in these unmodified retail versions. Is it that these patterns were intentionally installed as "backdoors" by the developers to simplify the development/QA/support process? Or is it more likely that the key validation used some form of home-grown hash/checksum procedure that had blatant but undetected weaknesses that end-users later found and exploited?

CD Key is a fundamentally flawed design. The software that checks the CD key validity runs on the user's machine, so it's running under the user's control. There's little that the software can do to protect itself from the user who knows what they're doing to bypass the check. There's little to gain for software vendor to deploy advanced security technique to prevent users from using pirated CD keys; it's simply there to raise the bar just enough to keep honest users honest, and not to keep pirates out.

Indeed, most companies that attempted to do anything beyond a very basic key checks have inevitably gotten a bad rep, because the techniques that they'll have to employ are very similar to what malware uses to hide itself, and they often get caught by anti malware software's heuristic scanners and such advanced techniques often increases the rate of legitimate users being unable to use legitimate keys. Some advanced DRM schemes have such a bad rep for using malicious techniques for implanting itself into the system so deeply, that they sometimes causes legitimate security issues on the system, which might cause some antimalware vendors themselves to consider flagging such advanced DRM as legitimately unwanted software and offer to remove them.

Many companies would rather have some pirates being able to break their DRM schemes, rather than having some legitimate user not being able to use their rightfully purchased keys. So, they keep the DRM simple and permissive by design.


Practicing pentesting locally After watching videos and downloading just about every possible pen-testing tool out there to play around with and learn. How do you setup test beds and practice scenarios to crack?

With RE people make crackme.exe files. I was curious do people have virtual machine templates and other setups created for download that you can practice cracking.

I run a lab on a KVM virtualization setup.  Among other things, I use Damn Vulnerable Linux, old versions of Ubuntu, and various VMs and software from VulnHub.  I have an ethernet bridge acting as an internal switch and a virtual router between my test lab and my internet connection to isolate tests like ARP Spoofing, subnet-wide scans, etc.


Does DNS allow third parties to register subdomains? I have one of those questions that rely on the rule sets for DNS lookup.

Let us say Person A owns the site https://www.example.com. A different person, Person B, not associated with A, attempts to register https://sub.example.com with the local registry. Will the registry allow this? Or is there an implicit understanding that these domain names are linked, and can't be obtained by third parties?

The reason I ask is that my university https://www.sydney.edu.au supposedly sent me a link in an email authored by notifications@instructure.com and this link directs me to https://canvas.sydney.edu.au/.

This looks bad to me. But maybe DNS rules only allow https://www.sydney.edu.au
to have the associated domain https://canvas.sydney.edu.au.

Otherwise, if any person (e.g. a Bad Person) can register https://badsite.sydney.edu.au and DNS lets it go through... then there is a hole in the DNS world that is made for badness.

Short answer: No, third parties can't register a subdomain without authorization from the owner of the domain.

DNS is a hierarchical system, ordered from right to left in the hostname. Whoever has a given domain name registered controls the authoritative name servers for that domain. This means that all queries (that aren't answered from cache) for that domain or one of its subdomains will be directed to that organization's DNS servers, giving them full control over all subdomains. They can, of course, choose to delegate this control to someone else if they wish.

For example, if I were to register reirab.com, if someone queries subdomain.reirab.com (and no cache is involved,) what would happen is this:

Their DNS server would first ask the root servers for the first domain from the right, i.e. com. They would be returned a DNS NS record telling them the authoritative name server for com.

Their DNS server would then submit a request to the com authoritative name server that it discovered from the previous request for reirab.com. It would again get an NS record response telling it the authoritative nameserver for reirab.com.

Their DNS server would now submit a request to reirab.com's authoritative name server for subdomain.reirab.com. Since I would own reirab.com, I would have full control over this authoritative name server. It would either be a server that I myself own or one that is hosted by a third party on my behalf. The only subdomains that could possibly be returned (authoritatively) for this domain are the ones I myself have created records for on that authoritative name server. The only way for someone else to register a subdomain of reirab.com would then be for them to ask me to set it up for them, since I own the authoritative name server for reirab.com and all requests for its subdomains would be funneled through my server.

If I did want to delegate control of some subdomain to someone else, I would do it exactly the same way my registrar delegated control of reirab.com to me: with an NS record. By adding an NS record for subdomain.reirab.com to reirab.com's authoritative name server, I can authoritatively direct requests for subdomain.reirab.com and any of its subdomains to the name server listed in that NS record, which would be controlled by the organization to whom I delegated control of that subdomain. I could revoke this delegation at any time by removing or altering that NS record.

By the way, 'www' is not treated specially by DNS. It's just another host name in its domain's authoritative DNS server. It's only by convention that we put the host (A or AAAA) record for that organization's web server there. The A record for www.exampledomain.com and somethingelse.exampledomain.com both most likely lie on the same server: exampledomain.com's DNS server.

Note: This answer has intentionally simplified things a bit for the case of someone requesting a DNS record from the Internet. If a request for a domain comes from within the domain's organization, the request will likely be resolved directly by the organization's name servers without going up the chain to root-servers.net, the TLD's name servers, etc. In this case, a host name could potentially even resolve to something different than what it would resolve to from the Internet, if the organization so chooses.


What can manufactures of hardware do to prevent attacks on the firmware? Given the revelations since The Equation Group was discovered. As well as that it is possible to not guarantee removal of a rootkit even with a nuke from high orbit.

What properties of a harddrive hardware can be added to prevent these rootkits from taking control/replacing of the firmware?

One solution is to require all firmware to be signed and have the device check the signature before writing that firmware image to its memory; my current laptop has an option to enable this in its BIOS (the option is permanent - if I enable it now I can't disable it anymore, that's why I didn't enable it).

There are many drawbacks however :

induces a false sense of security, as we don't know how the manufacturer protects the private key used for signing and I don't expect them to admit their failure and send a nice "Sorry the firmware key leaked" email to each customer; also even if the key didn't leak, the NSA and other evil agencies may still have stolen it and no one would know.
making custom firmware is impossible - while I'm fine with the fact that they're for-profit companies and their firmware is closed source, I am definitely not fine that they prevent me from installing whatever I want on my own devices I paid money for, for some so-called "security" even though the NSA already stole the key from them (I remember installing a custom BIOS on my old Thinkpad because the original one had a wireless card PCI ID whitelist preventing me from changing their outdated 802.11g for a 11n model, something impossible with firmware signature checks in place).

Another, better solution is to require physical intervention (a press of a hardware button on the device itself) to allow firmware to be installed, which doesn't have the above drawbacks; the firmware authenticity check is to be done by the user and he is free to install whatever he wants. Whether the user wants to install firmware, he presses the button and the device allows one firmware install before locking itself again (or timing out after a minute if nothing was installed).

The only drawback with that option is each device would have its own hardware button, on a typical desktop computer there's the BIOS/EFI (which will often update everything else embedded on the board - NIC, "fake" RAID controller, etc), possibly the third-party video card's option ROM (also called video BIOS), third-party RAID controller or NIC, storage drives, etc.

While everything on the board could be wired to a single button, all third party hardware would have its own button, sometimes hard to press due to the hardware being inside the computer's case. This isn't too problematic as users incapable of opening a computer case usually don't update firmware anyway due to the "risk" (it's minimal but creating bootable DOS disks feels scary) and complexity.

A theoretical solution would be to require all commonly used ports (SATA, PCIe, etc) to include a dedicated "firmware flash" line that would be hard-wired to the board's main firmware flash button.


Making website queries and return a large amount of data, can it be exploited for DOS attack? I am testing a website (bug bounty website) and found an endpoint like replycomment?cmt_id[]=1. When open on browser, this endpoint let me reply to comment with id 1 by fetching this comment into a textarea and format it for me.
So i can do like replycomment?cmt_id[]=1,2,3,4 to fetch value of multiple comments.
I try to create the longest possible comment and fetch this comment as many times as possible(450 times for now)

The website response with 30mb of data
The website response in 2.5 seconds, this is the time server take to prepare data, not actually transfer 30mb of data.

Is it feasible for a DOS attack? If yes, what is your reasons to believe so?
Thanks everyone.

The fact alone that a site returns large amount of data does not mean a DOS. Many sites do this, like all the download and video portals. Don't confuse this with amplification attacks just because a small question leads to a large response. Amplification attacks are about directing this large response to some victim, which is not possible here, i.e. the original client has to read all the data.
This does not mean that there can be no DOS attack here. Maybe it is possible to use the arguments to cause complex queries against the database which causes a slow down of other clients. Maybe the application retrieves all results in memory first and one might cause memory exhaustion this way. Maybe maybe maybe ... The given information are not sufficient to decide if these things actually happen or not.


Which passwords to exclude from a password manager? The benefits of a password manager are clear. Still, it seems that there might be a case to keep at least some passwords out of it:

Your primary e-mail, to minimize the "single point of attack" problem, as well as potential two-factor authentication lock-out problems;
Your bank account(s) and accounts with financial information, to avoid terms-and-conditions violation;
Access codes to physical hardware.

This answer suggests that such accounts should be picked based on (a) level of vulnerability in case of account compromise and (b) level of trust in a password manager.. If all excluded accounts are protected with two-factor authentication and passwords at least as strong as the one protecting the password manager, however, wouldn't exclusion be useful for risk disaggregation as well?

Is there a different trade-off than risk aggregation vs. convenience?

The vast reduction in risk you enjoy simply by using a password manager (no password reuse, stronger passwords, phishing resistance, etc.) dramatically outweighs any minuscule additional risk of keeping your email password in the same vault. That is, assuming you protect the password vault with a strong password.

Additionally, those accounts are the ones I try to most protect, and a password manager makes it easier to do so. The password for my email account and banking accounts are the strongest I can make them, and I rotate them somewhat regularly. There's no way I could remember four or more 50+ character passwords that are rotated two to four times a year.


What does 'verified file' in Windows mean? And does it guarantee related files? Often when I run a .exe file in Windows, a small box pops up that shows that file is from a verified publisher (e.g. Microsoft) or in other case, unknown publisher.
I know public key encryption can guarantee the integrity of a file. The questions here are:

Does Windows calculate the whole content of the file?
Because I doubt it does that, since some files are very large, e.g. several GB and Windows shows verified publisher after just a few seconds. If I copy that same file, it takes around ten minutes, so I assume the time to read the whole content of the file is much longer than just several seconds.

If Windows does not read the whole content of the file, how can it guarantee the files integrity?
E.g if some parts of the file are injected with malfunction code, I think the only way is to read the whole file's content and then calculate checksum. I can't see anyway to verify integrity without reading the whole file's content.

In some cases where I downloaded a large file, e.g Visual Express iso file, and then mount it. When I run setup file, it shows that file is from a verified publisher, e.g. Microsoft. The problem is that, the setup file's size is only several MBs, and it installs the content of several GBs.
So does the verification of the small file (setup file) guarantee the content of related files (often much bigger). If this is the case, how can it be done and done very fast)?

When Windows verifies a file, it must compute a hash of the file, and match it against the digital signature. In order to compute the hash, Windows does need to read the entire file (see this MSDN blog post). Copying a file will naturally take longer than just reading it, as it require write operations, in addition to reads.

If Windows did not read the entire file, it indeed could not verify it properly.

When you run a small setup file that copies other data to your computer, the only signature being checked before the UAC appears is the signature of the setup itself. You are not guarantied that the other files have not been tampered with. You can only hope that the installer does it's own checks before copying the files.
There has been malware discovered in the not so distant past (PlugX for example) that used legitimately signed executables to load malicious DLLs.


HOWTO : Email encryption in a browser I have read about encryption and I think it's a good idea for me to encrypt my email. I run ubuntu 12.10 and use Firefox for browsing.

In my quest for learning how to use gmail/hotmail to send and receive encrypted emails, a couple of older tutorials point to firegpg a firefox addon but the projects homepage says that it is no longer under active development.

I also read that encrypting within the browser is also dangerous as javascript running on the page can transmit the unencrypted data, so it is better to have a separate program that does this job.

Is there a fairly recent howto or guide available on the internet which has all the details so that even a beginner like me can follow along. If so it would be nice if someone can point me to them otherwise if someone could explain how their email encryption workflow works.

I have no problem composing my email in a text editor and then encrypting them and sending that text in the mail body but I don't fully understand how I'd manage all the public keys of my contacts. Is there some program that does this?

I'm not looking for email clients like thunderbird, I want to use a web browser for email it works out much better in my experience.

Email is usually/historically encrypted using PGP or GPG. There are PGP and GPG addons for most common browsers;

You will need to generate a key-pair for yourself and follow basic key-management procedures. This is all fairly long-winded to put into an answer on here, but there are some GUIs available that make the process easier, such as GPG4Win.

The major caveat with all this is that you will need to convince your friends to participate. They have to decide to send you encrypted email, and likewise they have to set up a key pair themselves in order for you to be able to send them encrypted email.

This lack of a ubiquitous web of trust subsystem is why email encryption is still very much underadopted. The widely used PKI doesn't lend itself so well to email, as it lacks flexibility and is prohibitively expensive.

Email at its core is just raw text transfer. That doesn't change when you start encrypting things. Typically the body of the message is encrypted using the public key of the recipient. This encrypted message is formatted into printable characters (usually with base64 encoding), this stage ensures that the encrypted block, which might contain weird and wonderful bit-sequences that map to weird, unprintable characters, is transferred safely by encoding it in simple characters (base64 uses the alphabet, numbers and a few common symbols).

The browser addons are able to identify this encrypted block inside the web page, and will allow you to decrypt it, which returns it into a plain text format.


Can my employer see what websites I visit at home on my personal devices? Recently I started working from home (like half of the world these days due to the Corona virus). Work has provided me with a laptop/screen etc. and a VPN to the company network. I only use this laptop for work purposes (but I am logged into Whatsapp and Facebook on it) and not outside work hours (although sometimes I forget to turn it off directly).

Today I received an e-mail from HR stating that they have done some tests, because the network has been bad, and that IT has concluded this is due to extensive use of sites such as Netflix etc. IT has provided HR with a list of IP addresses where this was ascertained. HR has requested everyone to stop doing this immediately. They consider this to be an incident, which they expect to not happen again.

This e-mail was written as if it was sent to the whole company. A list of the 'guilty' IP addresses was stated in the e-mail and everyone was asked to check for themself if it's you (due to privacy regulations, they say). However, I explicitly saw my only name in the 'receivers' of the e-mail, so it appears as if they know who they sent it to and put everyone in BCC?

At first I laughed at it, but when I saw that it appeared to be sent only to me I decided to check the IP. And I've double-checked about 10 times so far, but my IP was clearly on the list...

Now I do watch a lot of Netflix since the quarantine, but I do so on my own laptop/phone and in my own time (or maybe once for 10 minutes on my phone during my lunch break).

Now I assume that they are referring to watching Netflix on the company laptop during work hours. And I want to reply and tell them that what they are saying (or basically accusing me of) is not true. But I also don't want to end up having any kind of problem with HR.

So now I wonder: can IT see what I do on my own phone/laptop, now I have a company laptop at home?

To me, it seems too ridiculous that this is what they are referring to. Besides, I don't think that they can tell me what I can and cannot watch on my private devices outside work hours. Or if I was living with someone, what a partner can and cannot watch on a private device while I work from home. But the e-mail is framed in such a way as if it is already a fact, that it makes me doubt about this.

I spoke about this to someone else, who thought that maybe IT sees that my internet is a problem. Tonight, I ran some speedtests and my download is 19 Mbps and upload is 3 Mbps. FYI: I work in customer service and I call over the internet (and do experience problems with this).

The other answer is technically correct in saying that it is possible to monitor your network from a device on the network. Sure, any adversary controlled device could potentially be used to pivot and attack other parts of your network, including monitoring.

But, the key word there is adversary. A legitimate company would not be actively attacking your home network from your work laptop. This would likely be illegal in nearly every jurisdiction. If you have evidence that your work laptop is performing malicious activity, that's an (unlikely) different story.

Simply put, your work should not be monitoring any traffic besides what is going through their corporate VPN. Why would they care what you do on your personal network, regardless of during work hours or not? Their concern seems to be resource use of the company network.

So, if you are not watching Netflix on your work computer, then it is likely a mistake on their part, or some other misunderstanding.  This boils down to more of an HR issue than a technical one.

My only other thought: do you live in a complex with other residents, all sharing the same internet connection (and public IP address)? If so, maybe somebody else also lives there who works for your company and is misusing the company VPN.


When to use a Bind shell vs. a Reverse shell? Metasploit question:-

I know what these shells are but am a little confused on the execution.

Assuming that you successfully get a meterpreter shell and want to upload a backdoor, what should you use as a payload in the backdoor file- should I use a TCP Bind shell or a TCP Reverse shell?

And, if I use Bind shell then what do I have to do to execute this?

Bind tcp opens up a port on the victim's device. Usually a machine is behind a firewall (or NAT) and firewalls don't allow ports other than a few specific ones (like 80, 443, 22, etc). Reverse TCP tries to connect to you (from the target machine back to you: you open a port and wait for the connection). The attacking machine (yours) has a listener port on which it receives the connection, after which, code or command execution is achieved. If it is remotely, port forwarding should be done on your router.


Can fuzzing be considered a software testing technique for any vulnerability type I'm doing a research on fuzzing and I would like to know the answer to the question in the title. The cvedetails uses the following categories for vulnerabilities:

 Bypass a restriction or similar
 Cross Site Scripting
 Denial of service
 Directory Traversal
 Execute arbitrary code on vulnerable system
 Gain Privileges
 Http Response Splitting
 Memory Corruption
 Obtain information
 Overflow vulnerability (includes stack and heap based overflows and other overflows)
 Cross site request forgery(CSRF)
 File Inclusion
 Sql Injection

What I would like to know is the following: can any software testing be considered fuzzing. So for example if I'm looking for SQL injections in some web application (like some CMS system) with sqlmap, havij, sqlninja, can that be categorized as fuzzing? Because on the other side, in all papers fuzzing is only references when looking for buffer overflows - stack overflows, heap overflows, integer over/underflows, format string bugs.

So I guess I'm asking is the following: can discovering any vulnerability with any automated tool be categorized as fuzzing?

Thank you in advance

The short answer is: no.

Here the long answer: The origin of fuzzing (or fuzz testing) is sending random data or slightly random data (i.e. sticking to a certain format or mutating something valid).

The goal of fuzzing is usually to provoke an application crash. This crash can then be analyzed with debuggers or memory monitoring tools (i.e. Valgrind) to see if a memory corruption vulnerability was triggered and fix (or exploit) it.

Fuzzing allows you to start the application with lots of invalid inputs and defer deep analysis of the application to when a known crash has occured.

Both fuzz testing and using a web vulnerability scanner have in common that they are techniques in the field automated vulnerability testing. Web scanners, however, finds specific vulnerabilities using quite strategic, sophisticated attacks. Varying assumptions, playing with input/output handling of web apps.
Fuzzers don't need to be that smart (although they may be, of course).

Oh, this might be less relevant but sqlmap, for example, does not only scan for SQL injection flaws but does a very smart job in exploiting them.


Mysql user privileges for update query In Mysql DBMS is it possible to assign USAGE privileges to a user which can do an update query? In order to prevent SQL-injection.

In mysql usage means that the only facility is to to authenticate the user. Typically a native database account would not be used for authenticating users.

If the user has update privileges (and the application is vulnerable) they can subvert the application.

If you are asking how to provision write-only access for a user, then this can be done by writing directly to the grant tables though this is frowned upon. A more sensible and portable approach is to grant only the exec privilege and use stored procedures with an explicit definer who does have access to the underlying data.


Using outdated ADSL modem with up to date router - Security Concerns My parents live way out in the middle of nowhere. The only service provider that is not satellite is Century Link, which uses ADSL / phone lines.
They wanted me to set them up, and the service guy was trying to charge them a rental fee per month for the modem; I dug around in their "old technology" bin and found a Westell Model 6100. Now, it doesn't look like this modem has gotten a software update for A LONG time. Last software update was 2012 from my research.
However, there is a way to put the modem in transparent bridge mode. So, I bought them a Asus AC1300 as a router.
I pass the internet connection along via transparent bridge mode to the router. This requires the router to have the PPOE password, but essentially nothing else sensitive.
The router has updated security settings (Firewall, NAT, etc). I configured it to be fairly strict while still allowing their devices to work properly.
Also note: I changed the default password for both the router and the modem.
Is this putting them at risk from a security standpoint?
I don't know a lot about networking, but I know out of date devices are bad. That said, it was my understanding that a modem itself does not contain security features; security features are controlled from the router.
One other thing worth mentioning: the modem technically did have a NAT, but once you put it in transparent bridge mode, it removes the nat and passes the public IP straight to the router. The router then uses that as the WAN IP.

I don't know if the modem has itself bugs which might affect its security even when configured as a dumb DSL modem (i.e. bridge mode). But due to NAT the internal network should be save from direct attacks from this modem. Security issues in the modem might though result in traffic modification and can thus indirectly affect the internal network. But the attack surface when used as dump DSL modem is likely way smaller so I think that this network setup is sufficiently secure.


CMC (RFC 5272) compatible CA server I need a CA server or any tool that supports Certificate Management over CMS (CMC) format, described in RFC 5272 (RFC 2797). I need a possibility to generate different Full PKI requests and responses to test a custom CMC implementation with.

I know that Microsoft's Enterprise PKI supports it but its not flexible.

Apparently, CMC is supported by the Red Hat Certificate System (see the documentation for the command-line tools CMCRequest, CMCEnroll, CMCResponse and CMCRevoke); and it seems to be also supported by its open-source counterpart, the Dogtag Certificate System. I am not completely savvy on the relationships between the two projects, but they are probably quite close. For instance, when someone asked how to test CMC with Dogtag, he was responded to with pointers to the Red Hat CS documentation.

I also found some very recent messages about people working on CMC support for EJBCA (but nothing complete yet).


Is it possible to hide my physical location from my ISP? It's generally difficult, if not impossible, to know how any given company is going to use the information they gather about you. In some cases, it's also night-impossible to opt-out of their data collection (because, for all practical purposes, you can't just not subscribe to the service) and certainly beyond your ability to control what they do with that data.

I'm primarily concerned with location anonymity. VPN services like TOR and others allow you to generally hide your physical location from remote servers across the internet. But the VPN tunnel still goes through your ISP, and so it's conceivable that they might be able to track your location regardless of what special software you're using. They may then share this data, or otherwise use it, in ways you might not find appropriate.

Can your ISP indeed know your physical location at any given time? If so, how? Are there ways to prevent this?

With few exceptions, your ISP most certainly can - and in all likelihood probably does - know your physical location at any given time. This stems from two general facts:

They are providing a service that you signed up for. During the subscription process, you most likely already gave them your location for installation and/or billing purposes.
They most likely own the infrastructure devices that are directly connected to your device, or the gateway device you're connecting to.

Essentially, the only relatively convenient, usually legal, and reasonably inexpensive way to avoid location tracking by your ISP is to not use your ISP. This means hooking up to the Internet at a friend's house, or some other location that provides free or guest network access. Unfortunately, that also means never using the Internet from home or on your cell phone.

Breaking this down into a bit more detail, you'll see how it's quite clear that your ISP not only can but most often must be capable of knowing your physical location. There are a few ways to get around this, but they're generally inconvenient, costly, and/or illegal.

1. Billing

Apart from courtesy "guest networks", Internet services are rarely just given away for free. (Even most guest networks aren't really free, or at least not intended to be - you're just not paying for the Internet service explicitly.) So, the ISP must have some way of charging you for the service.

Unless your ISP permits you to physically visit their offices and pay them in cash every month, the billing process will usually require some collection of personal information. Normally, this includes the mailing address that is associated with your payment mechanism. For most people, this also happens to be their business or residential address. In the case of non-wireless services, this is also probably the location from which you'll be consuming the service (i.e.: connecting to the Internet).

In some cases, you may be able to avoid giving away your physical location through billing processes. For example, you could use a P.O. Box as your mailing address. However, some ISPs and/or payment providers (e.g.: credit card companies or banks) may not permit this.

2. Installation

Non-wireless broadband Internet services generally require some amount of equipment to be installed, or special cables run, at the location from which the services will be used. This necessitates telling the ISP where you're going to be connecting from, so that they can send technicians out to set up the devices and cables necessary for you to connect.

You can get around this by using wireless services, such as your cellular phone provider, but these connections are usually slower and less reliable and they often can still be traced. Another work-around could be using dial-up connections, but these will likely be even slower and again are still not immune to other tracking mechanisms.

3. Emergency Services

If your ISP is also providing cellular, VoIP, or other phone services, they may be required by law to know your location in order to properly route emergency calls and direct police and rescue personnel to you when needed.

One way that providers may do this is through a GPS receiver in the device that is used to initiate the emergency call. In the case of VoIP services, the receiver may be built into the VoIP gateway. This is why some providers will recommend that you place your gateway device near a window during setup (if not permanently) - that enables the built-in GPS receiver to have better visibility to the satellites required to determine its location.

You could try to negate the GPS lock by use of a Faraday cage or other GPS-opaque structure over the gateway device. However, if your service is coming through a wireless connection, this will most likely degrade or flat-out kill your Internet link as well. Besides, if a GPS lock is not available (or the system isn't using GPS to begin with) the provider will usually fall back to mechanisms listed in other sections of this answer.

4. Subscriber Authentication

When you connect to your ISP, the network will need some way of authenticating you before providing service. This allows them to verify that you are indeed one of their customers, and to determine what quality of service (e.g.: bandwidth allowances and caps) they should provide to the connection per the terms of your subscription.

This is practically unavoidable, without illegally hijacking someone else's authenticators. While it may not necessarily provide your ISP with your location directly, (except perhaps by way of items 1 and 2) it does enable the ISP to associate location data gathered from other sources (e.g.: items 3 and 5) with your identity.

5. ISP-Owned Infrastructure

This is the piece that is probably the hardest and most expensive to avoid, and is effectively the whole reason you have to pay someone else for Internet service. Chances are, the device that your system is directly connected to (if not, then probably the first hop outside of your LAN) is owned and maintained by your ISP.

Your ISP probably also controls the next few devices after that, and these devices are not likely to be easily accessible - lat alone movable - by you. By the very nature of their business, the ISP must know the locations of these devices in order to maintain and repair them in a timely fashion when needed. If these devices aren't actually in the same room or building you are in, they are still probably very close to you - within a couple miles or less.

This applies to most wired and wireless broadband services. For wired services, the "gateway" device that is on-premises is usually provided and maintained by the ISP. If not, then it will be the next hop after that and a few more from there.

For wireless services, the ISP will usually own the transceivers (e.g.: cell towers) that your device is directly communicating with. If your device is only within range of one or two provider-owned transceivers, they may not be able to pinpoint you very closely. Three or more, and they can usually nail you down pretty well. (Of course, your device is only ever actually using one of the ISP's transceivers at a given time, but they will often have several within "listening" range of your device in order to have good service coverage.)

The workarounds for this are usually fairly expensive, very inconvenient, or flat-out illegal. In some cases, it may be just plain impossible. Essentially, they all entail getting your device off of ISP-owned infrastructure for at least the first hop past your LAN.

For wired connections, this tracking will often not be avoidable because the gateway links that your device needs to connect to are unreachable outside of the ISP's networks. A likely exception to this would be dial-up networks. However, these links tend to be very slow and they are usually still traceable to some extent via Caller ID. (Caller ID can be spoofed, but that is often illegal.)

For wireless connections, avoiding ISP-owned infrastructure usually necessitates substantial physical relocation (or subscribing to a provider who does not have transceivers near your usual location) and will often incur additional fees (typically called "data roaming charges" or similar) as well as service degradation and/or limitation. If the wireless service is through a device also used to make phone calls (as most wireless Internet services tend to be), trying to avoid ISP collection of location data like this could ultimately be foiled by item 3 above anyway.


How do I use nmap to scan a range of IPv6 addresses? I need to scan a range of IPv6 addresses with Nmap, but I'm not sure how to do this. When scanning for an IPv4 range, I would usually do this:

nmap -sP 192.168.*.*

or

nmap -sP 192.168.1.*

but if I need to do this with an IPv6, how would I do it?

I would assume that the range you are trying to scan is fe80:0000:0000:0000:0000:0000:0000:0000/112 which is the last 16 bits (the last section) of the address.  That range includes 65,536 IPv6 addresses, probably all of which are going to time out when scanned.  It will probably take most of a day (86,400 seconds - close enough to 65,536 at one second per timeout on average) just to ping that range to determine whether the machines are up or not.

But such small ranges are rarely seen.  ISPs are often handing customers a /64 range each, (and it seems this is what you have) meaning that the customer has 18,446,744,073,709,551,616 individual IPv6 addresses.  Scanning a single customer like this would take years.

There are discovery protocols that exist to allow you to find the exact IP address you need rather than scanning the entire range and these might be a better place to start.

There are some existing answers here that may still help: Which tool (apart from nmap) can I use to scan a range of IPv6 addresses?


Which hash-length is more secure? If a hash algorithm has an option for selecting the output-hash-length (e.g., 128 vs. 512 bits), and all other aspects of the hash function are the same, which hash-length is probably more secure/useful, and why?

How Hashes work

The concept behind hashes is very simple: take a message of arbitrary size, and deterministically produce a random-looking output of a given size. For a well-built cryptographic hash function, the only way to break it is to try random inputs until you get the hash value you want (collision or pre-image, etc).

Which is more secure?

All other thing being equal (ie it's the same algorithm, just with a different output size, ex.: SHA2-224 vs SHA2-512), then the larger the output of the hash, the more secure it is. Reason: if you have a 224-bit hash, then you expect an attacker to have to make 2223 guesses (on average) to break it, whereas a 512-bit has requires the attacker to make 2511 guesses (on average).

Which is more useful?

This one I can't answer for you, it depends on a lot of factors about the application that's using it. For example, whether you have memory, bandwidth, or processing constraints, whether you are able to easily upgrade your infrastructure if the 128-bit hash gets deprecated or if the solution you're setting up needs to be future-proof for 10 years, etc. With only the information you've given, I can't answer this for you.


How can we embed an exe containing a payload into a pdf file I have created an exe with a payload which gives me a meterpreter session. But I need to embed this exe into a pdf. Upon opening the pdf the exe ideally should get executed. Is there any way to do this embedding and auto run of exe. Thanks

Yes! Embedding is very easy, it's a bit harder to open it. Here's the Javascript to run it:

this.exportDataObject({
    cName: "myExploit.exe",
    nLaunch: 2,
});

Adobe Reader and others won't let you just run any file although, like .exe/.vbs etc., so you need to find a way to bypass it. There are methods described in the reference article below, if you would like to go a bit deeper into that.

Reference article:
https://nora.codes/post/pdf-embedding-attacks/


Approved Certificate Authorities for certification/compliance with HIPAA, PCI etc Are there any requirements in PCI or HIPAA, or other security standards that may impact general government, payment processing, healthcare, that would disqualify any CA vendors that are trusted by the major browsers from being a valid choice for public facing websites? Or that prescribe a list of specific CA vendors that are approved? Are there any known downsides to just going with the cheapest vendor that is browser trusted and can issue certs that meet other requirements like sha2, 2048 etc.

I’ll address HIPAA first, since it is an actual regulation you are required to comply with (assuming you are s covered entity) whereas PCI compliance is a contractual requirement imposed upon merchants by their banks / merchant account providers / gateway processors.

HIPAA does not have any specific technology requirements with respect to SSL certificates.  It does require that PHI be encrypted BOTH in transit and at rest, but generally defers to what is considered “best practice” for the technical details, as defined by the National Institute for Standards and Technology.

As a general rule, I would imagine that the firm that does your audit will ensure that you are using modern TLS protocols and a strong enough encryption level for your certificate and also ensure you are properly encrypting the data in whatever storage system you are using.  In my experience, these things are less “pass / fail” and more of a scoring continuum.

I’d imagine you’d get a better score on your audit if you use a full EV SSL certificate from a major vendor that does a deep background check on your firm to ensure both the business (identity verification of who you are) and the technical (certificate configured to use modern / strong encryption) instead of using Let’s Encrypt or something to generate a perfectly valid certificate.  Neither should result in you “failing” an audit, at lease not in my experiences.  I’ve used CloudFlare’s shared SSL/TLS certificates with no problem in the past, though YMMV.

I found this article helpful in understanding the distinction between what’s required and best practices.  Also, I tend to use the Qualsys SSL/TLS Online Testing Toolto review client configurations during my own audits, and you might find it helpful.

PCI-DSS Compliance is a little different.  They DO specify (and update over time) the requirements on what specific TLS/SSL encryption technologies are required for compliance, though you should generally be able to comply with any of the above I mention earlier.

If you want to gain a higher score on your audit (and potentially lower your Merchant Account transaction fees & cyber insurance premiums, go for the fully paid high-end EV certificates.  That’s a business decision more than a technical decision and any of the possibilities discussed above should meet your technical needs assuming you follow best practices.


Is it common for a One-Time-Password system to become unsynchronized? One-Time Passwords look like they can play a helpful role in a layered-security system, yet their use, especially paper-based TANs seem like clients could be vulnerable to getting out of sync with the servers.  Is this a common problem with One-Time Password schemes you've seen implemented and, if so, are there best-practices that can be implemented to minimize these occurrences?

If the better implementations are not vulnerable to falling out of sync that would be helpful note as well.

Disclosure: I work for a company that builds an OTP-based 2FA server.

Yes they can and do become unsynchronized assuming it's not a time based OTP. Assuming we're talking hardware tokens, the biggest reason these things become unsynchronized (believe it or not) is usually because someone's toddler likes to press the button repeatedly. Followed by fat-fingering usernames and/or pins.

If you're using a device that doesn't have it's own power source, e.g. USB-powered, it doesn't get out of sync very often unless you like pressing the button while plugged in. To combat this problem, often times the server will generate 15-20 future iterations of the password after a successful authentication, and future authentications will validate against these values, and then after the next successful auth it will generate another 15-20.

In the event things get totally out of sync you could potentially enter the next 2-4 OTP's generated by the token, and the system will scan from what it thinks is the current key until it finds matching passwords, up to say 100 iterations. This will allow you to resync the key states.


How do I handle HTTPS certificates for a device with dynamic IP? I'm fairly new to HTTPS and therefore risk this being a dumb question. I have a server hosted on my Raspberry Pi that allows me to configure it remotely, over a network and I'd like to convert to HTTPS to make it more secure. But since the IP address of the device changes from time to time due to DHCP, I'm not sure how to provide the certificate.

The best solution I've had so far is to generate a self signed certificate every time the device boots up and add security exceptions to my browser which doesn't seem like the best approach to me.

Apart from making it Static IP, is there any other solution I can use?

Why not register the certificate for a fully-qualified domain name, instead of for the IP address? Assuming you're running it as a server, and leave it running for good stretches of time, you'd visit the DNS provider, and change the mapping between IP address and domain name, only when you received a new IP address.

Additionally you could request a static DHCP lease for the MAC address corresponding to your NIC. Then each time you rebooted, the DHCP server would provide you with the same IP address.


Certificate Renewal: What stays between an existing expired certificate and a renewed one I see that except public key mostly everything else changes after the certificate renewal; should I reconfigure the programs/softwares to use the renewed certificate? if there is 'something' that stays the same after the renewal, I can use 'that something' to identify the certificate. can any one help me here?

Most software, particularly web browsers use the Common Name, and Subject Alternate Name fields to ensure the certificate is valid for a site.

If the identified (be it IP address or hostname - whichever is used to access the site) aligns with a CN or SAN and the certificate otherwise passes validation (accepted certificate authority, start and end dates, etc) then that certificate is considered valid.

Most likely this is mandated by the RFC, but I'm not particularly familiar with that, so I'm speaking only from observation - not with any authority.

Note that this is a massive oversimplification, HSTS and certificate pinning often play a role these days too, which can make an otherwise valid certificate invalid.


How might a PIN based Web authentication scheme work? I'm interested in implementing PIN based authentication for a web application, similar to what Facebook provides in their mobile web site.

Here is the user flow:

User visits the site for the first time in a new browser and enters username & password at prompt.
User is prompted to create a 4 digit pin.
On future visits to the site from the same browser only the user can authenticate just by entering the 4 digit pin.

Debugging Facebook in a web browser, I can see that the server returns a new "nonce" after the user sets the PIN and after each successful PIN based login. This nonce is stored in the browser. When the user attempts a PIN based login, the stored nonce and PIN are sent to the server for validation.

What I don't know is what's likely happening on the server.

What might the server be storing? A hash of the nonce + PIN?
How might the server be validating PIN login attempts?
Are there any reference implementations for a system like this that I could look at?
Assuming that the content stored in the browser is not taken by an attacker, is it possible for this system to be at least as secure as traditional username/password authentication? If not, what kind of attack would it be more vulnerable to?

Your question seems to be both about, what does Facebook do, and what could be done. I don't know what FB does, but I can try to make some good guesses at what makes a secure system. I hope that helps.

Let me try to rephrase what Facebook is doing. Sites typically support a single factor of authentication, something you know (ie: your password). Sites that support a "remember me" functionality, use the something you have factor (the "something" is the cookie in your browser). This can be weaker as anyone with access to your browser, even a remote attacker, can now log in as you. But not having to type your password every time you access a site, especially if you have a strong password, is a hassle. So Facebook is choosing a middle-ground, basically having a two-factor "remember me" feature where you need the nonce (something you have) and your PIN (something you know).

  What might the server be storing? A hash of the nonce + PIN?

It is very likely that Facebook is storing a hash of the nonce+PIN. Note that this could be a simple, secure hash instead of something like the more complex bcrypt password storage function. A hash such as SHA512 is irreversible when operated on large, cryptographically random data strings. The nonce is (presumably) such a random number.

  How might the server be validating PIN login attempts?

The server simply redoes the hash and compares it against the appropriate field in the database.

  Are there any reference implementations for a system like this that I could look at?

Not that I know of, maybe others can help.

  Assuming that the content stored in the browser is not taken by an attacker, is it possible for this system to be at least as secure as traditional username/password authentication? If not, what kind of attack would it be more vulnerable to?

If we make that really big and unfounded assumption, this system is more secure than regular uname/pwd as this has the effect of making the password the concatenation of a cryptographically secure random number, the nonce, and the PIN. Cryptographically secure random number passwords are very strong.

But, in the real world, browser data can never be assumed to be secure so the security of this mechanism boils down to the security of the PIN and nonce. That is difficult to put concretely. This is definitely more secure than simple "remember me" functionality. If your browser data is reasonably secure, this may be more secure than standard passwords. Otherwise, standard passwords may be more secure. In almost any situation, this beats weak passwords because of the something you have factor.

Some points of note:

The server must perform the hash. If the client were to do the hash, then a stolen database table could be used as login credentials. This can't happen with the server performing the hash because the hash is irreversible.
Extra security could be added by using a password storage function such as bcrypt instead of a standard hash. This is only needed if you use a shorter nonce. Longer nonces will provide sufficient protection against a brute-force attack, even with a simple SHA512 (or similar) being used.
I think it makes sense to record failed attempts at PIN logins and, after say 3 failed attempts, delete the PIN login from your database and force the user to login with their password. This provides a lot of protection against a dictionary search for the PIN, even in the face of a leaked nonce, as the PIN will be rendered useless. Even if the user reuses the same number as a new PIN on their next login, they will get a new nonce that an attacker will need to steal to try more PIN possibilities.


Public Digital Signature Validation with JWE After reading JSON Web Encryption (JWE) and making a Node JS JWE POC demonstrating key mode using Key Encryption. I'm a bit confused as to how to validate that the sender of the message was in fact, the actual sender (not a man-in-the-middle with access to the public key).

With PGP, public keys are exchanged, and the message is validated against the digital signature. Is it possible to do the same with the JWS and JWE specs? I had a feeling this would somehow be done in the ADD, but doesn't appear to be the case as this is computing the AAD for the purpose of the Auth Tag. Obviously the Public Keys would have to be exchanged for this to work.

With JWS you can use one of the signature schemed supported. Broadly there are three options - HS, RS and PS - HMAC , RSA PKCS 1.5 and RSA PSS respectively.

The payload and protected headers would be signed and the signature would be transmitted. As far as overall security is concerned, be aware of alg:None issues with JWS libraries and the possibility kg replay attacks if exp header isn't included.


Using encryption key as input keying material Libsodium supports Blake2 for key derivation. It seems like you shouldn't truncate the output to get two keys (eg one encryption/one mac) as the recommended way is to use a counter as the salt for different keys.
Would it be ok to use the encryption key as input keying material for Blake2 to derive a mac key and then still use the encryption key for encryption?
I know it should really be a master key for the input keying material but it's not possible to use a counter as the salt in my case. It's also not really possible to use a random salt in my case.

First, the premise of this specific question is suspicious: why do you want a MAC key and an encryption key, rather than a single authenticated encryption key? Unless you're implementing some legacy protocol, use AEAD. That being said, I'll answer the question you asked.

No, this is not ok. Never use the same key material for two different things. This is bad, both for cryptographic reasons and for key management reasons.
The cryptographic reason is that different cryptographic mechanisms might involve related calculations. If you feed them the same secret input, some intermediate calculations of one mechanism might coincide with intermediate calculations of the other mechanism. For example, this is what broke OCB2: it's an authenticated encryption mode that didn't sufficiently distinguish the keying material used for the authentication part and for the encryption part, allowing an attacker to obtain an authentication tag by requesting the encryption of some data. Reusing key material directly for different mechanisms at worst leads to trivial attacks, and at best puts you in uncharted territory which is still not acceptable when it comes to cryptography.
The key management reason is that keys used for different purposes usually have different risks, lifetimes, risks and reaction to compromise. For example, if an encryption key is leaked, all data encrypted with that key is compromised. On the other hand, if an authentication key is leaked, data protected by that key is still safe if you can guarantee that it was generated before the leak.

If you need to store a single piece of secret data but you need to use it as a key for multiple purposes, apply a key derivation function (KDF) to that piece of secret data and use disjoint outputs for each purpose. You can get disjoint outputs either by running the KDF once and splitting the output, or by running the KDF multiple times with different non-secret parameters.
Since that stored piece of secret data is used for key derivation, it must not be used for any other purpose.
With libsodium, the recommended way is to treat each key as a subkey, following the example in the documentation:
#define CONTEXT "Guest's application, version 1"
crypto_kdf_derive_from_key(encryption_key, sizeof(encryption_key), 1, CONTEXT, master_key);
crypto_kdf_derive_from_key(authentication_key, sizeof(authentication_key), 2, CONTEXT, master_key);


Is it safer to download torrents over Tor or a normal Browser? I'm asking this question because I really want an explanation, I'm not familiar with this type of stuff. When I downloaded the Tor browser it told me not to download torrents because there was an exploit people were using when you do so. I was confused because Tor is looked upon as the safest of browsers.

Why is it unsafe to download Torrents from the Tor browser... If that's the case wouldn't it always be unsafe to download torrent.

So what's safer? Tor Browser? Or a browser with a VPN?

The Tor project recommends that you don't use Tor for BitTorrent traffic because there are numerous anonymity leaks in the protocol.  Even more so, if you only download the .torrent via Tor but open it in a client that's configured for standard non-Tor operation, you've gained essentially nothing in anonymity, as the client will send the tracker information about your download (assuming you're not relying entirely on DHT).  The Tor Browser Bundle is principally concerned with anonymity, and that's what it's warning you about.

Security is a different matter.  When using Tor, you funnel your traffic through several nodes, and thus open yourself up to a man-in-the-middle attack.  This is one of the reasons it's very important to combine Tor usage with HTTPS, which will provide (within the limits of HTTPS, which is to say "mostly") a guarantee that your traffic hasn't been tampered with.


How to download PHI PDF from a secure website to a secure, encrypted folder on Windows 7? Objective: HIPAA compliance.

Here is the process:

Receive PDF File through secure website
Open the PDF (Which involves downloading to some folder)
No longer need PDF

The Question:

Is there any way to simply view the PDF in the browser without ever having downloaded it? Or can I use a secure app for Chrome/Firefox to store the temp file in order to view, and then records will be deleted when I exit the browser?

If this cannot be done, is there any way to download that PDF directly to a password-protected, encrypted file folder. Then open it from there.

Workstation: Windows 7, any browser, only one account (so permissions for different accounts is out)

Does anyone have any ideas for solutions to this?

Idea 1. Install full-disk encryption on all client machines.  This way, the PDF will be downloaded to the machine, but it won't live in cleartext on the hard disk.  You will have to investigate whether this works well with people's work habits and whether it meets HIPAA compliance requirements.

Idea 2. Don't send a PDF file to the client.  Instead, render the document on the server side.  For an illustrative example, look at Google Docs, which renders a PDF file on the server side, converts it to HTML, and sends your browser some HTML, which then is displayed by the browser.  This way, there is no PDF file stored on your hard disk.  Obviously, you're not going to use Google Docs to render sensitive medical PDFs, but you might be able to build some simple web application or server tools to render the PDF on the server side.  For instance, you might be able to use ghostscript to convert the PDF file to a series of PNG images, then have the web page include the dynamically generated PNG images (not the PDF file itself).

One last reminder. Remember that if you don't want the contents of web pages to be stored on the user's hard disk, the web server will need to send special HTTP directives to instruct the browser not to cache the documents.  Otherwise, by default HTML pages will be stored in files on the hard disk in the browser's disk cache, so even non-PDF pages could end up stored on the client machine's hard disk if you are not careful.


Can a pop up ad install malware if we immediately close it? Can malware be installed without permission (a drive-by download) if a pop-up ad is closed within a second of it opening?

More specifically, can it be installed after the ad is closed, not during the one second that it was open?

Note: I had just Microsoft Security Essentials running for protection at the time. which is useless

A popup is not required in a drive-by-download malware infection. In fact the popup you see could just be created to distract you from the actual infection and thus closing it will not stop the  infection, even if done quickly. So yes, you should worry if you see a popup the same way as you should worry if you don't see a popup because the infection can be done in both cases.

  Note: I had just Microsoft Security Essentials running for protection at the time.

According to Microsoft the infection rate on systems with always on real-time protection is still about 3..5% so don't expect a full protection. Source: Microsoft Security Intelligence Report 19 Page 89 figure 66.


How do I check if KPTI is enabled on linux? The Meltdown attack FAQ says that KPTI is the fix for linux. How do I check if KPTI is running/enabled?

Linux kernel logs the KPTI status on boot so, running the following command would print the status on patched kernels. If it prints nothing then, KPTI is disabled.

dmesg -wH | grep 'Kernel/User page tables isolation'

Linux Kernel 4.15rc6 has enabled KPTI(Kernel page-table isolation) and it has been back ported to
Linux Kernel 4.14.11, 4.9.74, 4.4.109, 3.16.52, and 3.2.97.

So, if you are running any of these versions KPTI is in place. Most distros(running any Linux kernel version) will push an update to the Linux kernel within a day or two to fix Meltdown and spectre.

Note: Add the parameter pti=off to the GRUB in order to disable the KPTI. For info: https://askubuntu.com/questions/19486/how-do-i-add-a-kernel-boot-parameter


Is dd-wrt generally more secure than manufacturer's firmware? I have been advised to use dd-wrt, for richness of features and heightened security.

The argument about security is that major manufacturers don't care much about the firmware, release with a lot of bugs and those become widely known. Consequently, just knowing the router model confers knowledge of many vulnerabilities to an would-be attacker.

Is this generally true? When looking for a secure home edge router, should I filter out the models that are not supported by dd-wrt?

Most manufacturer's firmwares for routers are actually built around the same open source software as open source alternative like dd-wrt. The real security distinction is not between a "manufacturer" and an "open source" firmwares; it is between a maintained firmware against one that is not. A crucial element for security is how promptly fixes for discovered security holes are designed, published, and installed.

If you take a router, install dd-wrt on it, and then forget all about it and just let it run without ever installing fixes, then your security won't be better than if you had left the manufacturer's firmware in place. The bright point of dd-wrt is not that it is "more secure", but that it makes it easier to install updates, and that is what security comes from. You still have to do it, though.


Is there any reason to enable "Windows Update" if you do not connect your computer to the network/internet? I am looking to have a computer that I want to keep development only, and try not to connect to the internet, or my network at all.

I am curious if there is anything wrong with not updating anything with Windows Update, on that machine, if I am not connected to the internet?

The only thing I've really seen on Windows update is fixes against exploits, and not really malware, so if I transferred files to the un-updated computer, could there be issues?  How likely would it be to get malware that could take advantange of an exploit that's patched on one machine, be able to get transferred to another, unpatched machine?  Thanks

EDIT:  I figured I would mention the reason I want to not update is because I have noticed many times in the past, including this new computer, that when I update there are many things that started to act up, or slow down.  For instance, trying to type a search into youtube will freeze, and then a few seconds later will type out everything I wrote.  This would NOT happen before updating.

EDIT 2:  Just a note that I am using Windows 7.

For development machines, it is not uncommon to turn off updates so that you have a stable environment to test on ("what?!?! .Net got updated?!?!). If it is isolated and you control what connects to and is loaded on the machine, your risks are low. That said, I'd still want to have some sort of 'refresh' process to regularly reset the machine to a known-good state, in case some form of infection occurs.

This means, though, you need to really, really control the computer. Like, make sure you scan the files you want to transfer before transferring, etc.

As for malware transferring to another machine: if the malware gets installed on the first machine, then sees that it can't exploit the machine, do you think it just deletes itself? There are many types of malware that look for new machines on the network, or any new connected devices to transfer to. They are called worms.


Strange file from YouTube I was watching the video linked below and every time I refresh the page, a file named f.txt is downloaded that contains the following text.

Video: https://www.youtube.com/watch?v=enbTb8PizTI

Text:

document.write('\x3cscript type\x3d\x22text/javascript\x22 src\x3d\x22https://sb.voicefive.com/c2/6035329/rs.js#c1\x3d3\x26amp;amp;c3\x3d8271572\x26amp;amp;c4\x3d60886142\x26amp;amp;c5\x3d114232512\x26amp;amp;c6\x3d\x26amp;amp;c10\x3d1\x26amp;amp;c11\x3d1497811\x26amp;amp;c13\x3d\x26amp;amp;c16\x3ddfa\x26amp;amp;ax_i\x3d\x26amp;amp;ax_g\x3d\x26amp;amp;\x22\x3e\x3c/script\x3e');

Is this a potential security risk?

This script shouldn't be doing that. Let both youtube and subscriber and the advertiser know. Rogue Ads aren't to be toyed with.
The decoded script looks like this:

<script type="text/javascript" src="https://sb.voicefive.com/c2/6035329/rs.js#c1=3&amp;amp;c3=8271572&amp;amp;c4=60886142&amp;amp;c5=114232512&amp;amp;c6=&amp;amp;c10=1&amp;amp;c11=1497811&amp;amp;c13=&amp;amp;c16=dfa&amp;amp;ax_i=&amp;amp;ax_g=&amp;amp;"></script>'
Turns out Voicefive is not for taking agressive advertising tactics: http://en.wikipedia.org/wiki/VoiceFive
Also for distributing viruses.... http://forums.anvisoft.com/viewtopic-57-6844-0.html

Summary

The add may or may not be malicious. Malicious javascript isn't always obvious. It may be trying to take advantage of a browser flaw you just don't have. However, given the companies reputation, I'd say it's trying something funky here.
Make sure to research the company distributing the advert. In this case VoiceFive has a very nasty track record.
Report it! Google does not take kindly to this kind of thing.


Would `cat /dev/random` be a denial of service to any other users of `/dev/random`? As in the question. Wouldn't cat /dev/random decrease the entropy estimate until it blocks, which forces the random device to block for all applications on the current system?

Yes it would. The blocking random device reads from a single entropy pool and blocks when the entropy estimate goes under a configurable threshold. At this point, any reads from the character device will block, regardless of who is reading. This is just one of many reasons why developers should instead use the non-blocking device or the getrandom() syscall instead.


Attacks against unencrypted android phones? So, I keep reading again and again that one should encrypt his android device.

But from an attacker's perspective, what can be done with an unencrypted phone? Can I extract all the files or possibly install malware by accessing the file system on the phone, or can I unlock the phone?

I have bought a new phone and I want to test what can actually be done. So, what can be done?

The main issue with an "unencrypted" device is obviously a local attack. Someone will acquire the phone in question and extract the typically personal messages, files, keys, and so on. An unlock pattern or PIN is usually required to go beyond that, such as installing/side-loading apps.

There are many tools on the market, and range in quality. Some are simple pieces of software which only work on phones without an unlock pattern, all the way to pieces of hardware which are capable of brute forcing both the encryption keys and/or unlock pattern.

Depending on your threat model, traversing an international border might be of some concern, or even if you live in certain countries. As Radio Free Asia notes:

  Government procurement documents cited by Reuters showed that police
  stations in almost every Chinese province have been acquiring special
  data-extraction devices for smartphones since the ...

The major concern really seems to be that people place banking information and other sensitive pieces of information on their phones. If it was stolen, it could lead to identity fraud, which is massive ordeal to sort out (see the first 3 lines of LifeLock's history). Information like a SIN/SSN can be easily converted for cash on the blackmarket, especially in volume.

Most device encryption succumbs to the very low-tech "rubber-hose" attack for obvious reasons. That is why threat modeling is important to do, as 3DES or RC4 may prove enough to stop street thieves getting information off the phone. Encryption doesn't prevent thieves wiping the phone and selling it "as is", or authorities forcing you to produce the encryption keys in one form or another.

Identity theft is a large reason why paper shredder campaigns are pushed to home/small office users, which can be offered as a comparison to "device encryption" on some level.


Assuming existence of sufficient number of benign inputs? I have come across multiple machine learning based security solutions that train their detectors/models using "benign" inputs. The assumption is that the operator has access to sufficiently exhaustive benign inputs (benign inputs that provide sufficient input and code coverage for typical usage).
Is that a realistic assumption in practice? Are there ways to automatically generate such benign inputs? Or are these solutions still in their academic infancy?

Is that a realistic assumption in practice? Are there ways to automatically generate such benign inputs? Or is that an academic infancy?

That highly depends on what kind of input data you're trying to simulate. So the short answer is: only someone who's familiar with your domain can decide that.

Here's what I mean: If the "benign inputs" you're trying to simulate is realistic user data from Google Location Services, or typical browsing behaviour on Amazon.com, then yes, the ability to simulate those inputs is "in its academic infancy".

On the other hand, if you're trying to pen test an application that accepts a standardized protocol - for example the Certificate Management Protocol (CMP) - which has a very small number of accepted message types (~30 for CMP), then no, it's actually quite easy to generate a complete and exhaustive set of example inputs.

So what are you trying to do? What type of input data are you trying to simulate? If you edit your question to provide more details, we can give you a better answer.


How to properly encrypt a communication channel between a client and a server (without SSL)? I have a poor knowledge in the world of cryptography, I'm just starting to learn it so I'm a newbie :)

As a project for getting into the field of cryptography I want to write a client\server program that can send and receive data in a secure manner (i.e encrypted).

Let's say I want to encrypt the traffic between a client and a server or between two clients. The service I'm running can only talk with the server or another client (which acts as server too) on a known port, the server basically listens for a connection on one side on a default port.

I want those services to be able to talk to each other with out the possibility that a third party who's listening on the network to be able to decrypt the content of the conversation or try to impersonate a service.

I'm not looking for a new way to exchange keys(or should I?), I can have the keys be saved securely in the services so when x sends a message to y, and back, they will be the only ones that can decrypt the content and response (off-course, only to a verified service).

side note, the key can be saved in the program - hard coded or it can
be generated from a combination of things (e.g IP, computer-name, user name or any other combination of constants) which can be passed to the
client so it will be able to generate the key (lets say I'm passing the IP, computer name and a random seed, there will be a known formula to create the key from those values).

I need to use a symmetric key for the encryption, but maybe I can try and use two pre-generated keys as SSL does.

I know that if I'm using the same key again and again, a third party can sniff the traffic and get the key (mathematics at it's best, how is it done?), the more data he will collect, the easier it gets(?).

So, what should I do in order to promise that no-one will be able to get the encryption key (eventually reading the data)? Which cipher should I use? What else I need to know before I start my journey?

This is actually simpler than the others have suggested I think. Here is what I propose:

Generate a public/private key pair using RSA. You can do this on any unix machine using openssl: openssl genrsa -out rsa.private 2048
Distribute the public key as hardcoded in your client.
When the client logs in, the client generates a private shared key (also using openssl, or another well known encryption library) and encrypts it using the public key.
all data between client and server should be encrypted with the new shared key for the length of the session.

There is a lot of other stuff you can do to harden it, such as limiting sesison length to one or a few hours before re-generating keys, having the server sign message digests, etc. A full understanding of encryption will help you understand what those are and why, but for a basic implementation (for medium to low value data) this should be sufficient.


Security of Windows Screen Saver Password How secure is the Windows screensaver password? Seeing that screen saver passwords are used in the corporate world, is there any way of bypassing the screen saver after it is already running? Could a CD/DVD/USB be inserted and a program ran to close the screen saver that bypasses the password?

Possible intrusion methods to achieve this could be a hard reset of the computer, change boot priority, and insert media with code capable of bypassing login credential requirements.

(Hiren's boot CD or F4UCD for Win7 and earlier versions can do this).

Without restarting the computer, as GZBK said, if autoplay or autorun is enabled, then a USB may be recognized regardless of the computer being  locked.

An additional method would require either a 0-day or unpatched vulnerability which uses the IP and/or MAC as a point of intrusion, making sure the malicious code has remote code injection abilities.  With this RAT deployed against the system via the network, you wouldn't need to bypass the login, because you would already have access.

For practical purposes, the answer to your primary question is "secure, but with flaws."

You are better off using it, and using a difficult password, than not using one at all.


Good book about Scapy Is there any good learning resources for Scapy apart from the official documentation? I am looking for a good book about the Scapy

"Security Power Tools" (O'Reilly Media, 2007) has a chapter on Scapy.

"Python for Unix and Linux System Administration" (O'Reilly Media, 2008) also has a short section on Scapy

Both of those books are available on Safari Books Online and Amazon.

But, it looks like the various online documentation sources are the best bet:

Scapy Documentation - This is from the authors.
The very unofficial dummies guide to Scapy


pgp public key failed to propogate I have been using pgp for years now, but usually email the person my public key and compare its fingerprint over the phone or give it to them in person on a stick. I thought I might try out the key servers a while ago and uploaded a public key with:
gpg --send-keys --keyserver keyserver.ubuntu.com C3582062D32255323DEABDEEFAA3632602ACD45

...which worked in that the key made its way onto that keyserver, and on the web page of http://keyserver.ubuntu.com/ if I search for a substring of the email address associated with that ID, it finds it. (keyID above is not the real one)
According to this answer, the main keyservers are :
http://keyserver.ubuntu.com/
http://pgp.mit.edu/
https://keyserver.pgp.com
..but I definitely could not find my key anywhere on the other two main servers even months after the upload push from the terminal.
Does anyone know if these keys are really supposed to propogate by themselves between the servers within a few hours or not? If so, what have I done wrong?
Otherwise, what is a list of all the keyservers where the key should be deposited such that all mail programs can retrieve them? Is it just those three?

You need to upload your key to the servers that you want them on, they are owned by different entities and do not synchronise their record. You are looking for the servers in SKS pool (that propagate their data across different servers that GNU GPG tries to read as default). I would upload the key to keys.gnupg.net fo the best visibility.


What are some risks of purchasing a "used" domain name If you purchase an existing domain name that was already used by someone else what are the ways in which the domain could have been broken by the previous owner? Are such problems common and are there tools to detect them before purchasing a domain?

Two examples:
An HTTP server serving the domain could have returned permanent redirect making a domain unusable for visitors that received the redirect until they clear browsers caches.

Similarly, a server could have returned HTTP "Strict-Transport-Security" header making a domain unusable over HTTP for visitors that received the header.

Any other examples?

Some common risks to check:

Domain has Bad reputation - check for any existing negative online reviews for the domain.

Domain is Blocked in search results - Risk of search engine turning off the domain in its search results due to the previous content, malware etc.

Domain is Black listed - Domain on black lists such as Web of Trust and spam lists.

Sometimes the Way Back Machine can show you the domain history.

EDIT:

IP / Trademark infringement - the domain you purchased may infringe registered trademarks: consult your legal advisor before purchasing


Is hashing a string a secure manner for generating passwords? I have several servers that I'm using for an online business. I have passwords for MySQL, Wordpress, SSH, FTP, Domain Provider, Paypal, and many more. I wanted to have a different, very long password for each service to minimize the possibility of brute forcing and of accessing my other servers in the event that one of the services experiences a security breach.

In order to accomplish this, I decided to hash the service name using SHA256.

So I would hash "Wordpress+MasterPassword" a fixed number of times and get the password that I would use for that service.

Is this a secure way of having different passwords for every service?

First things first, you should use a password manager to solve the problem that you're trying to solve. A 256-bit hash like SHA-256 outputs to 32 bytes of hexadecimal characters. This means that for every character, there are 16 possible choices, 0-9 and a-f. Using a password manager like KeePass, you can generate a 32-digit passphrase using 64 or more possible characters per digit, which makes brute forcing harder.

Offline password managers like KeePass use a single strong passphrase of your choosing to encrypt a database of as many passwords as you like, so those passwords can be as complex as you'd possibly want. You should definitely do that rather than rolling your own methods of generating passwords. Rotating passwords becomes easier as well.

Now comes the cryptography to answer the general question implied by the title.

No, you should absolutely not do your own hashing of passwords.

There is an entire class of cryptographic algorithms called "key stretching functions" or key strengthening functions or password-based key derivation functions which are designed specifically for taking a key and generating a secure one-way hash which is resilient to the kind of attacks you care about. Use Scrypt if it's possible, Bcrypt if Scrypt isn't possible, and PBKDF2 if neither Bcrypt nor Scrypt are possible. There are libraries for these key stretching functions in your language of choice.

A hash function is a cryptographic primitive. There are a few applications for using SHA-1 or SHA-256 directly, but deriving passwords is best handled by key derivation functions. A good use case for a cryptographic hash function as a primitive is for generating checksums of files. Hashes were designed for exactly this use case: verification without authentication.

Cryptographic hash functions were not designed to resist the kind of attacks that key stretching functions are supposed to stand up against. Programs like oclHashcat can compute anywhere in the range of 1 billion SHA-256 hashes per second on fairly inexpensive hardware. Key-derivation functions like Scrypt and Bcrypt were designed to be attacked and to slow down attackers so that they can generate, say, one password per second on a CPU core. Scrypt was designed to be flexible to prevent the GPU attacks that oclHastcat leverages against these algorithms.

As many key stretching functions use either a hash for the input or for the output, the question is raised: what does a key stretching function give me that a hash does not? Doesn't the attacker still need to sweep the whole key space, as in 2256 in SHA-256's case? The answer to that is decidedly no and here's why: hashing (and even salting!) a user-entered password isn't going to distribute well over 2256 choices. Since computing SHA-256 is so cheap, computationally speaking, I can just brute force and start with 'a', then 'b', etc. at billions of times per second. Alternatively, I can use a good word list like the RockYou list, and oclHashcat will try these out for me and even append random salts to them; all this is done billions of times per second, so it's not that hard. A key stretching function on the other hand, should fairly evenly distribute the key over the entire key space (ie 2256 choices, more than the amount of particles in the known universe), making every password search more or less exhaustive if the function is a good one.  Do remember that if you took a 1PB (petabyte, 1000/1024 terabytes) file, generated a SHA-256 sum of it, then flipped a single bit at some random place in the file, your second SHA-256 sum would be completely different and would be entirely unrelated to the first checksum.

If the key stretching function is well enough implemented, the attacker will be forced to use their brute force attacks or their wordlists (or both) on the key stretching function itself, which is designed to be slow. This means that they're left without options and forced to wait beyond the lifetime of the universe ;)

TL;DR: Store your passwords in an offline password database like KeePass, and if you're trying to derive passwords, use a key-derivation function. That's what both of these things are designed for.

In order of priority, use one of the following offline password databases:

KeePass (best compatibility across operating systems)
Password Safe (no Linux)

In order of priority, use one of the following KDFs:

scrypt
Bcrypt
PBKDF2


Is Schneier's "Applied Cryptography" current? I've been recommended Bruce Schneier's 1994 book Applied Cryptography as an introduction to the use and the inner workings of cryptography. Is this book still current and a good introduction?

It's still pretty good as long as you are aware of what it's missing. My short list, keeping in mind my interests are only for a small subset of cryptography. Also keep in mind I don't know the book by heart and went by the index to confirm my memory, stuff may still be there but under another entry

Regarding algorithms, their mode of operations and protocols using them:

No AES, AES came a few years after the book
No SHA-2, came even later than AES
MD5 still represented as viable, as it was at the time
ditto for SHA-1, which is still true but not best practice anymore
no GCM chaining mode, that is now decently popular
no specific SSL/TLS, x509, ssh or OpenPGP discussion whatsoever, that would cover a good 90% of the practical cryptography usage we see today

Regarding attacks, missing a whole lot of attacks that were discovered/popularized later

differential power cryptanalysis
differential timing cryptanalysis
fault inducing cryptanalysis (I'm likely not using the right term here)
attacks on protocols using their error reporting, e.g. padding oracles

Those missing attacks are pretty important as e.g. most naive implementations are very vulnerable to them and it's very hard to harden aware implementations against those.

The consequence is that the book cannot be relied on at all for current best practices for the implementor, but is still very educational on the subject. But unsurprisingly, the field changed a lot in 15 years.

Also the book is very light on still used protocols, very heavy on exotic primitives, so of little practical value for people using crypto primitives as tools packaged in a library to implement practical solutions.

I would not buy one new today.


Does PCI-DSS password guidance apply to service accounts? A service account is a user account created for the sole purpose of running an application. For example, an online banking web site may have a single service account under which the code runs.

Service accounts, like any other accounts, have passwords. They differ from end user accounts' passwords in two important ways:

The passwords are
generated by us (and they are big and random)
The passwords are stored by Windows so that it can start the services when needed without human interaction.

I am trying to figure out what sort of password management process we need to stand up around these accounts.

PCI-DSS guidance sets the following general guidance for passwords:

Assign all users a unique ID before allowing them to access system components
or cardholder data.
Control addition, deletion, and modification of user IDs, credentials, and other identifier objects.
Immediately revoke access for any terminated users.
Remove/disable inactive user accounts within 90 days.
Limit repeated access attempts by locking out the user ID after not more than six attempts.
Set the lockout duration to a minimum of 30 minutes or until an administrator enables the user ID.
If a session has been idle for more than 15 minutes, require the user to reauthenticate to re-activate the terminal or session.
Change user passwords/passphrases at least once every 90 days

But some of these rules do not make any sense for a service account. For example, maybe it doesn't make sense to enforce lockout. And it could be a real pain in the neck to change the password every 90 days, if the same identity is used for a series of microservices, for example.

Do any of these rules apply to service accounts, or only to end user accounts? If the rules are just for end user accounts, what rules exist (if any) for service accounts?

(By "apply" I mean "are considered during a PCI audit")

Your use of the word 'guidance' is a but off.

Under the standard there are 4 parts per requirement:

The requirement itself
Testing procedures
Reporting instructions
Guidance

These can be found under the ROC and Standard documents in the PCI SSC Document Library.

Requirement 8.2.4 states:

  Change user passwords/passphrases at least once every 90 days.

It has its matching Testing Procedure:

  For each item in the sample, describe how system configuration settings verified that user password/passphrase parameters are set to require users to change passwords/passphrases at least once every 90 days.

Its guidance however provides the intent behind the requirement:

  Passwords/passphrases that are valid for a long time without a change provide malicious individuals with more time to work on breaking the password/phrase.

So IF you can show you can pass the intent (guidance) without changing your password every 90 days without using another requirement (by compensating control worksheet) by say, having a password with such complexity that its hash can not be cracked within its used time, with additional logging (above the requirements) etc.  Then the QSA might say the requirement has met the intent.

Some definitions of what counts as an 'Admin' account for your service accounts (however 'the standard' overwrites all FAQs and 'Guidance' documentation at will of PCI and the QSA).


How to make a decent Certificate Signing Request (CSR)? I'd like to know how to make a decent Certificate Signing Request (CSR) to secure my website and e-mail with a wildcard SSL certificate.
With recent exploits as POODLE on SSLv3 and such, I'd like to know how to make a decent Certificate Signing Request to make a valid (and very secure) certificate and order one. I'd love to have a high bits key (at least 2048 bits, 4096 bits if possible).
I know where to order, but I would like some more advice on creating the request.

Can someone give more advice on how to make one and on why chosen for those options?

Thanks!

When you create the Certificate Signing Request, you simply need to specify what level of encryption you desire.

For example, for 2048-bit:

openssl req -new -newkey rsa:2048 -nodes -out Test.csr -keyout Test.key

There are a bunch of tools here that will tell you what command to use based on your Operating System and requirements: https://www.digicert.com/csr-creation.htm

When submitting your CSR, make sure you are getting a SHA-2 certificate, as SHA-1 will soon be obsolete.

For protecting against POODLE, as raz mentioned, it is not about the certificates installed. It is up to how you allow your server to authenticate encrypted communication. All versions of SSL need to be disabled on your server to force authentication over TLS instead.


Simple way to encrypt files on Linux and decrypt on Windows? We are in need of an encryption process for backups of very valuable data. This data will be stored on a distributed filesystem, so even with permissions set right, it's not out of reach that this data is copied or read. I'm searching for a reasonably simple method to encrypt tar archives and only have them readable by three individuals.

After lots of searching, I would like to know if GPG with reasonable key lengths (pub/priv keys) could be used or if a symmetric encryption scheme would be as secure. I'm favoring a public key approach because I could automate the encryption without storing the password.

The private keys or password can be transferred reasonably securely out-of-band and I would like the data to be unreadable without the keys for long term archiving.

Edit: I guess the big problem with publicly accessible backups is the keylength. I don't want the data to be readable in five years. Even going to 2048 Bit doesn't guarantee me, that a smart researcher doesn't come up with a new attack.

I guess if I'd need at least 20 years, 4096 or even 8192 Bit are reasonable?

Entropy for the generation is also a factor I'm looking at, but I have a fairly good randomness source (not a PRNG) and am just checking, how GPG can use it.

Any other thing I have to consider?

Edit II: The target audience is me and two colleagues, so I assume that after consulting a HowTo written by me, the other two will be able to use GPG4Win.

I'm trying to protect against users reading the files, of course. The files will be semi-available to a wider audience (think of a corporate network where every workstation is partly part of a distributed replicated filesystem like GlusterFS). I also need to protect the integrity of the files, not so much their availability (Gluster takes care of that).

GnuPG is indeed the way to go. A Windows build exists at Gpg4win.

Using asymmetric keys means that whatever encrypts the data (the backup system) needs not know any private data element, thus its compromise does not allow an attacker to decrypt past backups. Also, you can encrypt the archive relatively to several public keys (this will not enlarge the data by much), thus allowing you to potentially "revoke" people (if you decide that one of your three persons should no longer be able to decrypt backups, you just stop encrypting the backups with regards to his public key, without having to change anything for the other two).


What happens if a page with an invalid SSL cert responds with a 302 redirect to a page with a valid cert? Do you still get the warning? Alice navigates to https://example.com.
https://example.com delivers an invalid certificate.
https://example.com 302 redirects to https://www.example.com
https://www.example.com delivers a valid certificate.

Question: will Alice see a warning on step 3

Alice will see a warning. This is because the certificate is checked at the point where the SSL negotiation happens, which is before you get the contents of the page - whether those contents are an HTML page or a status code with a redirect.

For an example of why this is important, imagine this scenario:

Evul manages (e.g. by DNS cache poisoning or some other technique) to get you to go to his server instead of the real https://example.com. Evul does not have a correct cert for https://example.com, but he wants to redirect you to a page for which he does have a valid certificate, for instance his very own site https://www.evulkrakker.com, knowing that once you're redirected there you'll see that it has a valid certificate.

If there were no warning at the first site, you'd never know that you were redirected to his evil site.


Is UUID v4 cryptographically safe for passwords? In terms of having enough entropy for randomness, can we consider UUID v4 to be safe?

For example, generating a random password like

>>> import uuid
>>> uuid.uuid4().hex

would that be enough?

I read that it was an entropy of 3.4e38, which seems reasonable, but my concern is more about if it's potentially guessable (for example UUID v1 leaks the MAC address, and other sources like /dev/random might not be utterly safe).

UUID4 does not rely on the machine's MAC address, from the documentation:

  If all you want is a unique ID, you should probably call uuid1() or
  uuid4(). Note that uuid1() may compromise privacy since it creates a UUID > containing the computer’s network address. uuid4() creates a random UUID.

However, UUIDs of any kind do not promise to be cryptographically secure as it is not guaranteed in the RFC. Certain implementations may use a cryptographically secure random number generator, but I wouldn't rely on it. I would choose to use another library if that is what is needed. If you are using Python3 you can use the secrets library which has functions for doing just this.