Are there totally isolated processes or services possible under Windows? I want to program a little security watchdog for my Windows 10 machine.
This watchdog should start directly after boot and should be active, no matter which user is currently logged in.

None of the users should be able to see, what's happening inside the watchdog (e.g. reading out memory to detect vulnerabilities) nor should be able to manipulate or inject something to it.

Is this even possible with Windows?

Some clarification:

So here is my (hypothetical) use case: I own critcal business data which I am fetching from an external source from time to time and I am doing some business logic with it. This process shall run, whenever the computer is on.

And now I fear that other users could see my data, by watching the (unencrypted) process. Of course I could move my logic to a cloud but there I have the same problems with admins I don‘t trust.

I just wondered, under which circumstances there is total process isolation possible with windows or maybe another OS.

One way to do this would be a kernel-mode software device driver (or, as other OSes would term it, a kernel module). Drivers are technically just another Windows service, in most ways (they don't show up in services.msc, but if you look in the registry, they're there alongside the user-mode services). However, they have advantages no user-mode process does. Most notably, they can read the memory of any user-space program, no matter how protected it is; with enough effort they can even read the memory of processes that run in isolated VMs on the same host. They are also in the best position to do things like make the OS lie to other processes about running processes, files and file contents, and registry keys and values; this is useful if you want to hide your service's existence.

Of course, the technical term for what you've written at this point is "rootkit". Nobody is going to want to install this thing on their own system, and if you do it without their permission you will be sued and/or arrested. It doesn't really matter what you're doing with it; no Legitimate process needs to hide itself that hard.

Additionally, there are limitations on how far you can go. Your driver can try to prevent any process from tampering with its file(s) on disk, but it can only do that while it's running; somebody with access to bootable media (such as a Windows install disk or a Linux liveCD) could easily find the files, registry entries, etc. and modify or remove them (this is, in fact, how the Sysinternals "Rootkit Revealer" tool works). Similarly, anything you can do, another driver could also do; yours might be able to prevent even another driver from noticing its existence, but only if yours starts first. Finally, a kernel debugger attached to a machine running this driver will almost certainly be able to detect (and tamper with or remove) it.

There's lots of problems with the driver approach, too. Writing drivers is tricky, and they need to be pretty much perfect. If they crash, the system goes down (BSOD). If they hang, the system may also hang. If they have security vulnerabilites, an attacker who finds one can use it to take over the machine. If they want to get really deep into the OS, they're run into parts that are not officially documented and therefore subject to changing when updates are installed, and that could turn a working driver into a crashing one (there's been a problem with pre-release "Fast ring" Windows builds and certain game DRM crashing them for months now, because the DRM was hooking parts of the kernel that it shouldn't). If they try and tamper with stuff too deep into the kernel, the kernel itself may fight back; there's a feature called "PatchGuard" that detects modification of many kernel data structures, and while you may learn to bypass one version of it, the next one might catch you. Finally, if you want to load your driver on 64-bit Windows, it will either need to be blessed by Microsoft (signed with a code signing key that authenticates your code) or will only be loadable if the kernel was booted in "testsigning" or "debug" mode. Both of these modes cause (deliberately) visible modifications to the desktop, and also disable certain parts of Windows (mostly related to media DRM), since otherwise a driver like yours could see what they're doing; to users, this will manifest as certain functions of the OS not working anymore.

There's a user-mode option if you don't want to go all the way into the kernel, but it's not going to work any better. Windows does have the concept of a "protected process" that can inspect and debug (meaning, among other things, read or write memory) other processes but cannot itself be inspected or debugged. These are called "protected processes", and while their presence is not secret, what they do is. However, protected processes cannot access as much stuff as a driver, are even harder to create than drivers (they're less delicate, but they not only must be signed, they need a special signature), and as mentioned they're less secretive.

Is there a particular reason you're trying to do this?


WhatsApp video from unknown source Today I received a video in WhatsApp from an unknown sender (a telephone number is shown but not saved to my contact list). The movie showing Homer Simpson as a thumbnail was sent with the message "Remember that times xD".

There are a few remarkable things:

English is not my native language (and thus generally not the one of my contacts)
the profile picture shows a couple (male and female) who are friends of me (!!!)
the guy is in my contact list
the gal is not
while I would expect a message of the man, I would be surprised about a message of her
I did not yet download the video of course

Is it a scam? How does it work? How should I react?

It may be a scam and/or an attempt to infect your smartphone with malware.

The profile picture may have been copied from your friend's Facebook profile, or may be fake. Either way, it doesn't prove that the sender is your friend.

The video may not be a video (link to malicious website), or may be a video someone wants you to watch in order to increase views and thus make money, or may be a child pornography video (which could get you in trouble). The possibilities are endless.

I strongly suggest you to not download or watch the video and to not reply.

If you think there's a small chance it may actually be your friend using another phone number, call him/her and ask about the video. If he/she denies, that's the end of it. If he/she confirms, you could watch the video (if you really trust this friend, and don't think he may be part of a scam or hacking attempt).

Keep in mind that, if you two are friends, he/she shouldn't get offended if you don't watch the video. In fact, you could use this occasion to explain your friend why it's not wise to open suspicious links, both on Whatsapp and on emails.


What to take into account when validating file upload One of the key security mechanisms for application software is input validation, which can protect the integrity of the system and thwart common injection and denial of service attacks.

Most of the internet can agree that prepared statements can validate against SQLi, and sanitization libraries (that are not vulnerable themselves) paired with output encoding can mitigate XSS. However, I found that recommendations for validation of file uploads are often deprecated and/or ambiguous.

To provide a context for our system:

It runs on IIS 10 (Windows Server 2016), which hosts a .NET application.
The application has an endpoint that is contacting an external service, from which it receives images.

For protective controls, we have mutually-authenticated HTTPS (based on a hardened configuration of TLS 1.2) and we have a whitelist of allowed IP addresses for our endpoint to contact (redundant with certificate checking, but we are aiming for defense-in-depth). Now, when it comes to the file upload, we are currently examining the following validations:

Whitelist of magic numbers - Currently we have magic number checking, and we are unsure how easy it is to spoof this value. Would adding validations for extensions or MIME add anything to this step?
File size and file name length checking - we limit the size of this data to avoid DoS.
Regardless of the original image name, it is renamed following internal system convention - in theory to avoid injection attacks through the name.
The image is scanned by an antivirus prior to any further manipulation.

Is our validation chain missing important steps? Since we're working with images, I've heard talk about reencoding them to remove attacks, but I haven't been able to find any details on this subject.

I think you're not missing something, and in my opinion there is no way to testify that an image is 100% clean unless you analyze it by hand, I'd say adding MIME validation (in both client and server side) is a step to do before validating against magic number, this will eliminate some script kiddies :)

Now if you really want to reduce your attack surface, you can first reencode the image into a simple/poor/trivial format,  in a sandboxed environment with a minimum privilege and no access to unnecessary syscalls. Once you get the reencoded file, you can re-reencode it to a more common format (png/jpeg..) At this stage you can trust the input since it comes from your system, and use stream or maybe memorystream to convert your image (try and catch everything !)


Are there any architectures currently out there that use hardware-enforced process isolation? What would it take to add that to x86? First-time asker/commenter, long-time reader.

As someone who's currently doing a lot of thinking & writing about measures that might foundationally improve computer security (ie., involving not just the kind of evolutionary, fairly modest steps that most tech makers are  focusing on right now, but pursuing "big leap" changes might break backwards compatibility but would make systems much more secure).  I am very taken by the idea of using robust general process isolation to try to prevent user-mode programs--or, anyway, what we today call "user-mode" programs--from being able to do nasty things like trying to read/steal data being used by other user-mode programs or hitting the OS with privilege escalation attacks.

Now, there are certainly companies/organizations out there who have tried or are trying to implement robust privilege isolation schemes in software. For example, Microsoft's developmental Singularity SO that put almost everything into"sealed isolated processes" that could only communicate with each other and the OS through restrictive message-passing "contracts". (There are certainly others, including some that are in use with governments for military/intelligence high-security scenarios, I understand.)  However, I suppose I'm a person who's reluctant to put tremendous trust in security defenses that aren't rooted, at the end of the day, in some sort of direct hardware-enforcement.  Which brings me to my two (closely-related) questions:

First, are there any non-government, commercially produced microprocessors out there today--that are intended for multi-purpose computing; no smart card chips or something--that use instruction sets/architectures specifically designed to enforce strong process isolation/separation? (Such that not even an attack exploiting a deeply-occurring flaw in the kernel of the OS running on the device would be sufficient to result in allowing malicious code in a process from breaking out of isolation.)

Second, what sort of changes would you need to make to the x86-64 instruction set & corresponding chip architecture to make it capable of providing hardware-enforced support to strong OS isolation/separation of individual processes?

(FYI, I do know that Intel has added some proprietary security capabilities to some of their chips over the last 5-10 years, with Skylake with SGX this year suppose to bring some capabilities to isolate a given program that has high-security needs from the rest of the system.  But much larger, further steps would be needed to pursue hardware-enforced isolation of, say, at minimum, all processes that today run in user-mode. Or am I wrong about that?)

Actually, almost all of the CPU on the market, save for the very small ones meant for low-power embedded devices, offer "hardware-enforced isolation". This is called a MMU. Synthetically, the MMU splits the address space into individual pages (typically 4 or 8 kB each; it depends on the CPU architecture and version), and whenever some piece of code accesses a page, the MMU enforces access rights, and also maps the access to a physical address (or not -- this is how "virtual memory" works). At any time, the CPU informs the MMU whether the current code is "user code" or "kernel code", and the MMU uses that information to know whether the access shall be granted or not.

The access rights and mapping to physical addresses of each page is configured in special tables in memory, that the kernel shows to the MMU (basically by writing the start address in physical RAM of the main table in a dedicated register). By switching the MMU configuration, the kernel implements the notion of process: each process has its own address space, and when the kernel decides that the CPU shall be granted to a process, it does so by making the MMU configuration for that process the active configuration.

This is about as hardware-enforced as these things can get. If you wanted a software-only isolation enforcement, then you would have to look at things like Java or C#/.NET: strong typing, array bounds check and garbage collection allow for cohabitation of distinct pieces of code with isolation and without the help of a MMU.

MMU-based process isolation works well in practice -- processes cannot alter or even see the pages of other processes. The last major operating systems where this was not done properly were the Windows-95 family (up to and including the infamous Windows Millenium Edition, in 2001).

The trouble begins when you begin to understand that complete isolation is useless: application processes must, at some point, be able to interact with the hardware, to save files or send data over the network or display images. Therefore, there must be some specific gateways that allow some data to flow in and out of the isolated address space of each process, under strict control of an arbitration system that maintains coherence and allocation of hardware resources to process; that arbitration system is exactly what is known as an "Operating System". The "gateways" for escaping isolation are often called system calls.

Right now, the OS is software, and has bugs, because every significant piece of software has bugs. Some of these allow for maliciously written process to impact other process in bad ways; this is known as "security holes". However, making a "fully hardware OS" would not solve anything; in fact, it would probably makes things worse. Hardware has bugs too; and the source of bugs is that what the developer is trying to do is complex. Doing it in hardware only makes bug-fixing a lot harder, so it does not improve the security situation at all.

Thus, to make a better isolation between process, the solution is not to throw more hardware at the problem. There is already enough of the stuff (and maybe too much). What is needed is a reduction in complexity, which really is a thorough pruning and redesign of the list of system calls. A basic Linux kernel offers more than 300 different system calls ! This makes for a lot of work when trying to prevent security holes. Unfortunately, removing system calls breaks compatibility with existing code.


How does Google locate me from my laptop? From this question I learned how Google locates me over BSSIDs.

But how does Google retrieve my WLAN-access-point-BSSID when I use Google's services (maps.google.com for example) in Firefox from a Linux-machine (no Android)?

I'm quite sure that there are/were several Android-devices connected to the same router together with my Linux-system. So I guess that Google simply looks up the dynamic (ext.) IP of our router in their database. Can somebody confirm this?

Or is Google able to obtain the MAC of our router?

No, I am not logged into a Google-account. Cookies are deleted when I close FF. And I definitely disabled location services.

There are a lots or ways to find a user's location, independent to the OS or device manufacturer.

Google is known to do wardriving, which maps GPS position
to router location (BSSID).
With your public IP, there are IP Location databases/service (NOT
BSSID) like:
ip2location.com, iplocation.net, MaxMind,
ipaddressservices.io ...
You don't actually need to do it, some else might update your BSSID
when it finds it on his phone and it does not even have to be an
Android device, Apple does this too and you know, how's the
business, it wouldn't surprise me that they exchange/sell info.


what is worth a digital signature based on email address only? I have noticed that most digital signature providers do not try to certify anything but an e-mail address, while it is quite easy to create an email address without disclosing any personal information.

Thus, I may know the e-mail address of a signatory and nothing else.

If a legal dispute occurs, how do I know who really holds the e-mail address ?  How to avoid repudiation ?

Why is it that apparently nobody cares ?

Actually some people do care, especially in Italy (I let you figure out why).  In particular, infocert.it proposes web recognition.

(https://www.firma.infocert.it/prodotti/firma-digitale.php?_ga=1.152428668.492019680.1448886434)

See also

http://www.agendadigitale.eu/identita-digitale/700_come-funzionera-il-sistema-di-identita-digitale-italiano.htm

in summary, you would get a digital ID after showing you real ID to somebody, possibly an official.

In Belgium, they (propose to) put a certificate into the ID card.

An intermediary way (safer than email, lighter than de visu recognition or making all ID cards smart) could be based on mobile GSM phone, as it is not normally possible (?) to buy a SIM card without showing one's ID and the buyer is responsible for its use and can revoke it in case of loss.

Do you know about digital signature based on SIM card ? Google gives some answers but I found nothing practical.

I am interested in practical solutions but also theoretical advice please.

This is essentially the same issue with Domain Validated SSL certificate. A domain validated certificate or email identity certificate asserts that you're talking to a system/someone authorized to use the domain/email address but doesn't tie the address with any real world identity.

A DV or email address only certificate cannot be used to verify whether the owner of the address is a decent person to do whatever business you want to do with them or that the person/entity behind the certificate is who you think they are. You're still left to yourself to determine whether the email address you've got is the correct email address of the person you want to communicate with.

The worth of email certificate is that it simplifies verification of the certificate because part of the checking process had already been done by the certificate authority. The certificate authority has checked that the certificate belongs to the authorized owner of the email address. So all you need to do is to check that the certificate belongs to the person in front of you.

If you meet someone you trust in person and he tells you his email address and where to get his certificate, you can verify that the certificate can be used to send email to the owner of that address without them having to read out the certificate fingerprint in person (as would be necessary with GPG if you don't already have a connection through web of trust).

There are several problems here. If you don't trust the person, then you don't have any reason to trust their assertion that the email address really belongs to them. However you can still be sure that if the person doesn't actual own the email address, he won't be able to receive any emails sent to that address or send any signed email from that address, as he presumably don't have the private key corresponding to that email address, and the certificate authority wouldn't have issued it to him.

If you don't trust the person's assertion of his email address, you can simply send an email to the address with a secret word and if he can read the secret word to you in person, you can be sure that the person standing in front of you had the private key corresponding to the certificate.


PCI DSS 3.2 SAQ A and SAQ A-EP - 2 different web shops I did a pre-assessment of 2 web shops of one company today.

One web shop uses Direct Post based forms to insert and forward cardholder data. Doing this means the company is eligible for an SAQ A-EP.
It's hosted in Azure, in a small environment, which is isolated from the rest.

The other one uses a hosted iFrame solution from a PCI compliant 3rd party. This could be done with an SAQ A. It's hosted in their own data-center though.

Does this mean that the company needs to follow the requirements from the SAQ A-EP globally, for both shops? Or can I scope the requirements per shop individually? And apply the SAQ A for the one shop and the A-EP for the other? At least based on the requirements that should be possible.

As I see, there are two web shops of the same company in scope where one has hosted its website in their own data center while other one has hosted on cloud (Azure). Since the first webshop uses iFrame to load pages of PCI-compliant 3rd party payment service provider, irrespective of where it has hosted its web it requires only SAQ A and quarterly ASV scans are absolutely optional. But in case of second webshop hosted in cloud that redirects card data to third party with https POST, not only SAQ-EP and quarterly ASV scans are required but also internal VA scans on quarterly basis and external penetration test at least annually are required as per the current PCI DSS standard v3.2. Since most of the leading cloud service providers are already complying to a number of international security standards you can ask for copy of their PCI certificate which is fair enough for SAQ-EP requirements.


Can a browser JavaScript console ever be an issue? I'm sure most of you are familiar with the JavaScript-based game Candy Box.

As you probably know, one can cheat this game's candy system by sending commands to the console.

For instance, if you click the link, you will see that your candy count increases slowly. Somebody using Google Chrome (I refer to Chrome specifically because I know the keyboard shortcuts; perhaps this can be done in Firefox or IE) who wants to cheat can press Ctrl + Shift + I, navigate to Console and send candies.setNbrOwned(2147483647) to the console for a quick and easy sugar-high.

Can this pose a problem in other contexts? For instance, let's say that I have a website that sells widgets. Can somebody's balance (or even the price of my widgets) be altered through sending something like userBalance = 2147483647 or widget.setPrice(0.01) by using JavaScript (maybe even without using the browser's JavaScript Console)?

If it isn't possible, why is that the case? My first guess for why it might not be possible is because changed variables would be stored as local variables and wouldn't affect anything major -- kind of like changing elements through 'Inspect Element' features.

If it is in fact possible, through what means can it be done, and how does one prevent it?

Yes it can be an issue but there are ways for applications to protect against it.

Two sides to every internet application.

In order to understand internet application security you have to understand the difference between the client and the server. Data which is generated by the client (the browser), must be sanitized and validated before being by the server.

If you had a website that sells widgets, you would never store a users account balance on their machine, in their browser. This would be like a brick and mortar bank asking you to take home the balance sheet, and bring it back when you are ready to make a withdrawal. Therefore the server side of the application must keep track of the balance, and only allows the client application to request actions be taken on their behalf.

How could I prevent people from cheating in my game

If the game is implemented on the client side, you can't. Any logic that is done on the client side can be altered. There are some ways to make it more difficult though. Minimizing and obfuscating the javascript will increase the time it takes to understand the code, but it won't really protect anything.

Ideally your client side logic would only represent the view and then send action requests to the server. The client view could always be altered but because all the real logic takes place on the server, the integrity of the game remains in tact.


Recover EFS encrypted folder after wiping system partition We've recently ran into trouble while reinstalling one of client's desktop computer.

Disk was split into two master partitions named C: and D:. We wiped out C: and reinstalled system (Win XP SP2 Professional)

Right after we realized there was folder with photos but protected by ciphering (EFS)

That means we have folder with files+folders but both encryption keys are gone.

I've tried to:

Find at least one of keys via utility for recovering deleted files
Connecting HDD to domain controller and taking over privileges

but neither worked.

Then I found two sw tools to recover EFS encrypted files (Elcomsoft AEFSDR and Passware EFS), but I think these tools can work only at condition we have one of keys or the key is present in SAM database.

I've got idea, that key could be probably recovered if I can compare encrypted and unencrypted versions of same file, but I haven't found any clue if this is really possible.

So question is:

Am I wrong about these sw tools?
If not, is there any way how to recover those files?

If the computer was connected to a Windows domain and the files were encrypted by a domain user it is possible you can use the recovery agent to decrypt the files (See http://support.microsoft.com/kb/308993, http://support.microsoft.com/kb/223316). You can use efsinfo.exe to determine this (See http://support.microsoft.com/kb/243026)

In this case you would use not change the permissions on the file you would just decrypt the files using the cipher command (See http://www.microsoft.com/resources/documentation/windows/xp/all/proddocs/en-us/cipher.mspx?mfr=true) with the recovery agent account (this would likely be the domain administrator but may be configured differently in your environment).

If you have the user’s ntuser.dat file from their profile you may be able to restore this to get the encryption key back. However the user must still be using the same password as when the file was backed up.

Hope this help.


How can I disable double request for detected port in Nmap? When I execute this command:

nmap -sT -p 5481,10212,19999,2308,102,502,20000,2000,44818,2222,47808,18246,910,912,1974,8086,8087,12397,12399,12401,20222,22202,46824,5002,802,27700,2869 --scan-delay 1s --max-retries 0 -Pn <IP>

I run into the following issue: whenever one of these ports is dectected, the request is sent again.

In this example, the port 2869 is up and I don't know why Nmap do a second check.

How can I disable the second request?

I'm presuming here that by "second request" you're referring to the fact that nmap is completing a "three-way handshake" for each port.

This is a natural function of the scan type you've chosen (-sT is TCP scan).  In this mode the scanner completes a standard TCP connection which involves multiple packets being sent.

If you want to have a single packet based request, use -sS for SYN scan, which won't complete the handshake.


Is there a security problem with having two factor auth running on the same machine that's requesting access? Searched around and couldn't find a similar question.

I've gotten tired of waiting for an 2FA SMS to come every time I check my email. So I got to setting up an app similar to say Google Authentication on my desktop, so that when I get prompted for a code I can just copy/paste from my toolbar.

I can see how this basically defeats the 2FA purpose though right?

It does not defeat 2FA. If someone steals only your password, or if you use the same password everywhere and it leaks, the second factor will still protect your account.

That's the purpose of 2FA: add another layer of security. Having both on the same device does not change that. That "one-password-for-everything" is still secured by 2FA anyway.


Are kiosk-style, full screen apps possible on iOS, Android, or Windows phone? A popular car insurance company in the US has an app that displays "digital car insurance" papers.  In the commercials, these apps are opened, and the user gives the unlocked phone to police officers.  It's not unreasonable to imagine what could happen in these situations when someone has unrestricted access to a phone.

Ideally if an app similar to this was in widespread use, I would want it to prevent switching to another app (email, contacts, SMS, etc) until a password was entered.

Other scenarios where this is useful is ID Cards, modal versions of popular apps (games), a parent who wants to control what apps their kid uses, demo phones at a trade show, etc.

Question

Can any mobile phone (iOS, Android, or Windows) support an app taking "full screen" control and not exiting until a password is entered?
If such a solution is possible, is it secure?  (Is the local data still encrypted?)

(I assume that Android and Blackberry 10 are the same since they can both run similar apps)

I know there is a great example and discussion on this for Samsung devices and Android, so you might want to start there and see if it takes you to where you want to go with everything else.

http://developer.samsung.com/android/technical-docs/Neat-tricks-when-implementing-a-kiosk-app

  Removing the title bar and status bar
  ... you may want to ... remove the app title bar and the system status bar, which will make an app full-screen. Please note that some devices (like the Galaxy Nexus or Galaxy Tab tablets) have another bar with buttons which are represented by hardware buttons in other devices. That bar cannot be covered by any app. In order to remove those bars, use the code below before calling the setContentView method in your Activity. It will request the extended feature (to remove the title bar) and set the proper flag to the window (to cover the status bar).

requestWindowFeature(Window.FEATURE_NO_TITLE);
getWindow().addFlags(WindowManager.LayoutParams.FLAG_FULLSCREEN);

  Prevent exiting the app via the back button Since the kiosk app shouldn’t be closed, you can handle pushing the back button and assign
  another action to it. For instance, you may want to go to the homepage
  when user tries to exit the app. To do so, override one of the
  Activity methods, which is called every time the back button is
  pressed. [or set this to null or refresh to keep it on the same display]

@Override
        public void onBackPressed() {
        mWebView.loadUrl(mHomepageUrl);
    }

  Disable the home button In general, disabling the home button is not a good practice, but it can be very useful when developing a kiosk
  app. Since Android 4.0 there is no effective method to do so, so you
  may need to use another solution, e.g. setting your app as a home
  screen, which is described further. However, for older OS versions you
  may switch the window type to keyguard, which will prevent from
  handling home button pressing.

@Override
        public void onAttachedToWindow() {
        getWindow().setType(WindowManager.LayoutParams.TYPE_KEYGUARD);
        super.onAttachedToWindow();
    }

  Set an app to cover the lock screen If you want your app to be visible all the time, setting it to be on top of the lock screen may
  be useful. This is quite simple to achieve, you only need to set few
  additional flags for your Activity window.

getWindow().addFlags(WindowManager.LayoutParams.FLAG_DISMISS_KEYGUARD);
getWindow().addFlags(WindowManager.LayoutParams.FLAG_SHOW_WHEN_LOCKED);

(snippets of the most useful elements of the document relating to a kiosk app)


What is the difference between patch management and vulnerability management? I've been thinking about this lately. are they the same thing? or is the latter has a lot more than just management of patches?

To find out the differences let's look at what these types of management actually do first.
Patch Management
Patch management includes the planning, acquiring, testing and installing of changes to a software. This can be any kind of software: operating systems, drivers, application software or firmware on appliances. A patch is not necessarily installed to fix a vulnerability, but it can be. Often times it is provided to fix bugs or to update a software to the newest version. In medium size or big organizations - places where you typically have a patch management - there are special software solutions in use to deploy patches to a big number of systems. To give an example: WSUS is such a software.
Vulnerability Management
Following wikipedia vulnerability management is:

the "cyclical practice of identifying, classifying, remediating, and mitigating vulnerabilities", particularly in software.

I want to add, that vulnerabilities are not only found in software, but can also be present in hardware and even in processes or things that are more related to "the physical world", like a door (e.g. a weak lock) or the windows in your office. But a typical vulnerability management will not deal with these things, althouhg it can. This differs from organization to organization.
See also the following definition in ISO 27000:

vulnerability
weakness of an asset or control that can be exploited by one or more threats

Vulnerabilities in software are often eliminated through the installation of a patch. This is why some people say, that vulnerability management is a part of patch management. I wouldn't say so, and here's why: There are sometimes scenarios, where you have to operate systems, that have vulnerabilities that can not be fixed. For example, you have a customer that wants you to run a server with a very old operating system. If the management thinks, this customer is important, you sometimes have no choice, but to accept the presence of these vulnerabilities and might not be able to patch them. You obviously have to install other controls to secure this server somehow. This would be a part of "managing" a vulnerability. (An even simpler example would be: sometimes there is no patch.)
Conclusion
Patch and vulnerability management sound alike but are different. Patch management deals with patches, updates and fixes of software that have to be installed for several different reasons. The rollout of these patches has to be planned beforehand and you need to know which machines need a patch at what time. (If you operate several thousand desktop PCs, this task is a lot harder than it sounds.)
Vulnerability management only deals with security (and sometimes safety) issues of (mostly) software. A lot of the time, these issues can be resolved with a patch, but certainly not always. Vulnerabilities can be present in all kinds of systems and can be eliminated with lots of different strategies. Admins can change the firewall policies, the network setup, buy new hardware, train employees etc. To fix a vulnerability with a patch indefinitely is almost always a very good solution, but it might not be always possible.


How to do Rijndael MixColumns step I am trying to go through all of the the steps in the Rijndael Encryption Algorithm using pencil and paper. I have been using http://www.formaestudio.com/rijndaelinspector/archivos/Rijndael_Animation_v4_eng.swf as an example. The mix columns step has a lot involved in it. To further explain it, I have been following http://www.angelfire.com/biz7/atleast/mix_columns.pdf . That is really nice because it uses the same numbers as in the first link. My problem is that when I get to the part that looks says this:

Now another thing to remember, there is a rule established in the multiplication of the values as
written in the book, Cryptography and Network Security[2], that multiplication of a value by x (ie.
by 02) can be implemented as a 1-bit left shift followed by a conditional bitwise XOR with (0001
1011) if the leftmost bit of the original value (before the shift) is 1. We can implement this rule in
our calculation.
{d4}.{02} = 1101 0100 << 1 (<< is left shift, 1 is the number of shift done, pad on with 0's)
     = 1010 1000 XOR 0001 1011 (because the leftmost is a 1 before shift)
     = 1011 0011 (ans)
    Calculation:
    1010 1000
    0001 1011 (XOR)
    ---------
    1011 0011

My questions is, where do they get the 0001 1011 from? They are supposed to XOR 1010 1000 by 02. Do I use this number every time, even for the next step which is {03} . {bf}? It looks like they use 0101 1101 for the XOR calculation.

It really helps to look at the pictures from the first link to follow along here.

For the time being, what I can say is that 0001 1011 is a value given and used in the book Cryptography and Network Security to quicken the calculation of the value (which is most likely been used in most of the computation) How do they derive the number? Well, I am not  really the expert but I believe this greatly involves Finite Field Theory GF(2^m). If I could get good example, I will probably explain it (if I can get the theory right).

While saying this, please be reminded that while using this method of bit shift and XOR, note that you should only XOR 0001 1011 when, and ONLY when, the first bit of the value is 1 before the shift. Therefore, in the example, 1101 0100 has its first bit as 1, so when doing a multiplication, it will need do an XOR 0001 1011. Addition to this criteria, this is only used when you are multiplying with multiplier of 2. Thus, in the second example in the document, {03} is broken down to {02} XOR {01} which is also suggested by the book and multiply respectively. I believe it is shown in the document.

PS. The calculation is up for reading, do let me know if you are feeling unclear: http://kwof.blogspot.sg/2014/05/aes-mix-columns-calculation-some-more.html


Could my pc's mac address be guessed and thereby stored by websites? If I don't use a vpn, should I disable IPv6 to avoid my pc's mac address be guessed ?
While paying online, once I saw a bill that included my IPv6, should I be concerned at all?

No. You should enable privacy settings for IPv6, so that you use a pseudo generated IP, and not one based on the MAC of the computer. On Windows this appears to be the default, although I have never studied IP allocation on Windows in detail with IPv6.

IPv6 can indeed increase privacy through the use of ephemeral addresses that are short-lived.

As with all technology, you need to understand it and quantify the risks.


Sending Emails to Distro List w/ Authentication? I recently wrote a scheduled job sends an email report to a Distribution List (DL) every day.

However, when I tried to send an email to this list using the Apache Commons Email library, I saw the following error:

  Your message can't be delivered because delivery to this address is restricted.

The following thread comments to un-check the Require that all senders are authenticated check-box - in order to allow my un-authenticated email to email the DL.

From a security point-of-view, would it be OK to un-check the above box and simply add a white-list exception for donotreply_my_fake_email@COMPANY.com?

In particular, my concern would be if someone sent an email to this DL, but included a malicious link.

Perhaps informing the DL recipients that the report email will never include any links would be useful? And, if it does, then they should alert me immediately.

Maybe you can know whether in your use case it is fine or not that the DL accepts mail for unauthenticated sources, but certainly I cannot!

Anyway, you have plenty of security options:

allow any sender to write to the list without authentication - low security as any one knowing about the DL could send anything there
allow only one sender to the DL. Attackers will have to fake the sender address to post, but it is not that hard - slightly higher security but still not that high
allow only a restricted list of authenticated senders. Nice security level, but it supposes that your report engine is able to authenticate.
do not secure the sending of mail, but sign them - recipients should simply control the mail signature

If it is a confidential DL and information is not really critical, you are on you own. Said differently, if the risk is low the security can be low too. In any other use case (important data or large diffusion DL) you should either sign the mails or authenticate senders (or both)


I stored a copy of my KeePass database on a portable hard drive and I lost the drive. Should I worry about that? I've been using KeePass for years, and I have a lot of accounts. I need to access them anywhere I work, so I store one copy of my database on a portable hard drive.

The drive isn't encrypted. The database is encrypted using AES-256 with millions of encryption rounds, but I only use a single password to open it.

The password is a combination of uppercase and lowercase characters, numbers and special marks, and is based on a number of random, unrelated words.

I've lost the drive. Should I worry about the database being cracked?

TL;DR: You can relax - your database is absolutely secure.

Technical details:
The encryption used by KeePass is not broken as of today. Brute-Forcing the AES-256 key is infeasible. Assuming your password has more than about 80 bits of entropy the millions of key derivation rounds render brute-forcing the password infeasible, too.

The entropy of your password depends on how well you chose your words. Lets do another example:
You chose 5 distinct words. The attacker must assume a set of about 7000 english words to not miss one of your words.
The words alone make up for 10^19 possible combinations. Lets further assume you changed two letters per word to a number or a special character. You chose numbers similar to the letter and random special characters from a set of 10. The letter exchange alone makes up for (13 * 13)^5 =  137 * 10^9 possible combinations.
All in all, that is about 1,3 * 10^30 possible combinations; equivalent to about 100 bits of entropy.

Brute-Forcing 100 bits is not completely impossible imo (128 is considered impossible pre-quantum; but 100 to 128 is a huge step). That effort is far beyond feasible for anyone else than large governments or enterprises. Unless you are Edward Snowden (which i am sure you are not since you asked this question), no one will go through that pain.
The large number of derivation rounds add to that, even.


Secure (P2P) Client/Company File Sharing my small web design company currently uses a cloud storage service to collaborate with our clients and I would like an easier (and more secure) way for files to be transferred-in and stored.

The only reason we use cloud storage is because most of those services have cross-platform mobile applications so we tell our clients to upload their files to our account through the convenience of such apps. However, I am not comfortable with these files being stored on a random server somewhere (unknown) in the "cloud" owned and accessible by people (unknown) in parts; unknown.

After a ton of research I ran into "BitTorrent Sync" which is literally everything I want. Files can comes in (to our central location; our office) and mobile apps exist for it so our clients can easily send us their files from most of their devices. However, is it secure? Is there a better solution and/or perhaps an optimal set-up?

All files transferred-in do not contain sensitive information and/or copyrighted (or illegal) content. However, they lose value if obtained without authorization. Especially if pirated. Imagine you spend two years writing a book and we are the publishing company. Imagine 95% of your work is stolen prior it is complete/polished/published prior going on shelves for sale. Make sense? We can't afford that!

That said, I need a set-up that is 100% secure and operates like BitTorrent Sync. I guess that's called P2P? I clearly have no programming or server experience/knowledge. I tried my best to learn and it does not register (respect to everyone in such fields).

Anyway, I am in need of a simple (but highly secure) solution for my clients to drop files to us. Cross-platform ways for them to send files is as important as the security + it would nice if the files are restricted to anyone that is not on our client list.

My question is... what can or should I do to accomplish this? Can a system be created where we continue to use BitTorrent Sync but on a secured device or dedicated/virtual server? Are their a ton of existing software that can easily accomplish this?

All feedback appreciated in advance. Thank you!

A solution has been in place for many years. It's called SFTP. It's a direct client-to-server connection with an encrypted channel for upload. The technology is so old that many, many clients exists and even some browsers will allow you to connect to SFTP servers.

All you need to do is to set up a small server on your end with access to the Internet. You provide the login details to your clients and they can upload to their heart's content.


native mac malware opening urls across all browsers I'm a security newbie so please excuse the solely high level symptomatic description of my problem.

My friend doesn't know how he got it, but he has some form of malware on his mac which, when he opens a URL, spontaneously opens an additional URL in a new tab. This occurs across all browsers so I'm guessing the malware is native. Anyone got pro tips for getting rid of it?

I was thinking of listing all running processes with ps aux, sequentially killing suspicious-looking  ones while opening URLs, until the spontaneous URLs stop, and then use the path to remove the executable. But I'm inexperienced at discriminating suspicious ones, there are 153 running processes, and I guess removing the executable might not be sufficient if the malware is sophisticated enough.

The obvious answer is to run anti-virus and anti-malware software, then check out some suspect directories. Then, if you cannot resolve the issue on your own, get in touch with Apple support. Please note they may recommend that you wipe your hard drive. Ignore that advice, persistently, and they will eventually escalate you to a level of tech support (telephone-based) that may screen-share with you and help you walk the directory structure looking for suspect files.

Self-help steps to try before getting to support:

Fix permissions using Disk Utility: permissions errors can lead to vulnerabilities. Also, finding out what has had it's permissions changed may give you some idea of what's being attacked. It is not really that likely to solve any problems... but you also need to make sure that any scanners you run can actually access the directories they need to scan... so not a bad first step.

Look at extensions/add-ons in your browsers and disable anything that looks funny. I know all browsers are affected, but... you may have crappy extensions put into all of them somehow.

ClamAV is a good piece of anti-virus software, that is free. Download it directly from their site, instead of using the AppStore -- for some reason the AppStore version doesn't let you schedule scans/updates.

AdwareMedic is a nice piece of anti-malware software that Apple support recommended to me, when I called them.

Adware Removal Tool (Bitdefender), caught some things that were missed by Adware Medic. It is also light and non-invasive.

Other software: there is a LOT of other software out there. And, as is the case with PC's, no single suite is comprehensive. You will probably want a second piece of anti-virus software... I just can't recommend a good one. I don't like most of the programs out there. Many of them are bloated. Many of them interfere with your system. Many do not uninstall completely.

Walking the directory structure to look for stuff... yes you won't necessarily know what things are named. But they're often named obviously-malicious things. If you use finder to look through your directories instead of the command line, you may want to try entering this into the command line first to make sure you can see dotfiles.

defaults write com.apple.finder AppleShowAllFiles YES

Just a couple of places to peek at for malware:

/Library/

/Library/Application Support/

/Library/Internet Plug-Ins/

~Library/

~/Library/Application Support/

~/Library/Internet Plug-Ins/

If you still can't find the issue, try rebooting your computer in recovery mode (command R on startup), and trying Safari there (Get Help Online). If that sandboxed version of safari is messed up you may have issues with your modem.

You can also try creating a different user account. A different account experiencing the same troubles... probably means you've got system files messed up, instead of ones installed in your ~ directories.

Good luck.


How to protect myself from cyberbullying? I want to learn how can I protect my PC from getting hacked in order to protect myself from cyberbullying. There is an intruder who has hacked my system over the last 4 years.

He has hacked my all emails, websites I log on to and whatever when it is related to me being online. He has a team of friends and has professional links all over the world.

When I make an email from another computer, I don't know how he comes to know about it but he knows my minute credentials of my account information.

When I go on certain websites my internet suddenly disconnects. I have to connect and reconnect my modem at least 200 times a day.

Even if I choose to take legal action on him,he would be locked up for some 6 months in a prison,but I have other plans for him(sorry for openly threatening).

I haven't used any of my emails (except reading) from last 3 years,he knows every website I visit on and that is how he uses me.

And I know all this, because he has accepted all these things over our chat.

Someone has advised me that I will have to become hacker to prevent myself. Is there any way I can consult a good security expert or an institution,where would I find it.

I live in India.

format your system
get an Antivirus and Firewall
secure all your wifi networks
make a new email address or change EVERY detail in your email account especially password and security questions. Your password needs to be strong.
file a complaint with your local police office
Don't share any details with anyone.
stop doing drugs.


Is there a security threat to a Windows XP computer only being used as an analogue fax server? The XP computer is not directly connected to the internet.  However, it is on the LAN where it holds analogue faxes for manual processing by staff.  The other computers on the LAN are all Windows 10 computers.  The entire LAN is behind a 3rd party firewall.

Despite this XP machine is not directly accessible from the Internet and there might not be attack vectors through the analogue fax machines, being on the same LAN makes it a good target for lateral movement and gaining persistence on your network.

I'd put this XP machine on a separate VLAN and isolate it as much as possible i.e. only allow the mandatory access for this legacy functionality. That could be e.g.

deny access from the machine to the Internet.

this must be done on network level, as once someone is already inside he can modify the settings on the local machine

deny access from the machine to the LAN

there's no harm to assume it could be compromised

allow limited access from the LAN to the machine

only the ports absolutely required
IDS/IPS on the traffic, if possible
if someone gets limited access to any of the LAN computers, he could use this to gain full access on this vulnerable XP.


Can I elicit responses from "any remote host" on "all protocols" if I want to? An nmap scan of my test computer returns a result of “5357 / tcp open wsdapi”.
After some research, this is something that can be exploited.
It is explained here that:

By default, WSDAPI will listen on TCP ports 5357 and 5358. The Windows Firewall will allow messages in to these ports if the interface firewall profile is anything other than Public. This means under non-Public profiles (e.g. Private or Domain) the vulnerability can be reached by remote, unauthenticated users.
For an attacker to be able to trigger the vulnerability on a target, they need to know the WSD Address value for the target, which is a UUID (Universally Unique Identifier). This value is automatically sent in broadcast UDP messages to port 3702 (WS-Discovery) in an effort to discover devices that support WSD. Being broadcast UDP the message will only be visible to attackers on the same subnet. Attackers on other subnets, or on the Internet, will not be able to launch attacks against distant targets using this approach.
A system could also be exploited by a malicious device which responds to a client computer using WSDAPI. It is possible for the user to manually enter the URL of a device to connect to, in which case the device could respond with a malformed message and trigger the vulnerability. This requires user-interaction and social engineering, however.

This makes me think.
Since I am fairly new to this field and struggling with this, my question now is whether I should and can generally elicit, in this case, an UDP packet response from a “remote host” to get this information and how can I do that? Or that something like this happens automatically and that the “remote host” in question does this on its own?
In addition, I would like to know whether it is possible for other protocols to elicit responses from any random device, whether it is connected to a network or not.

I will start by answering your last question first.
What you asked is, “is it possible for protocols (agreed upon methods of communication) to elicit a response from any random device, wether it is connected to a network OR NOT.”
How would two devices, one that is connected to a network, and one that is not (one that is essentially air gapped), pass traffic to each other?
In order for any two parties to communicate, there must be some method for data to pass from source to destination and back. If you are in Hong Kong, and I am in Alberta, and I think, gee, I hope Freddy Nova hears my thoughts.... You see what I am saying. There needs to be a path of communication to follow, we don’t use magic.
Perhaps you meant to ask if there are methods for exfiltrating the data you are asking for while not being on the same network? The data you provided said there is. What is that method?
That is outside the scope of a question answer site like this. It depends on what type of systems are inside the network, what systems you have access to, what apps on those systems you have access to, what you are allowed to do. You’re asking for someone to provide you an exploit (without enough data to do so).
This is the subject of a class, not a question. If you want to learn how to do these things, or figure them out, I’d recommend hack the box. You can learn how to exploit things like this yourself.


When to use Session key or Premaster Key I feel like I am getting a little bit confused about how the first half of TLS works. From my understanding, it's like this:

Client sends request to Server (with cipher suite preferences)
Server acknowledges requests, decides on cipher suite, and sends its certificate to client

Now this is where I get confused. This link, like many others I've seen, suggests the Session key is encrypted with the servers certificate and sent directly over the network. However, then I see articles like this that suggests that a premaster secret is generated on the client and encrypted using the server's certificate. This means the key is never sent over the network.

So which is it?

Pre-master key and Session keys are two different things.

Pre-master key is used to provide a greater consistency between the cipher suites that belong to the client & the server. All your subsequent keys are derived using the pre-master key.
Read this link for more details: What's the point of the pre-master key?

Session key on the other hand is the symmetric key that you will to communicate further. Session key is derived using the pre-master key.


Would a RansomWhere application be possible for Windows too? This is related to RansomWhere? which is a OS X specific defense developed by a former NSA employee.
The premise is that it will "generically" stop ransomware from encrypting files on the OS.

Scope
RansomWhere? only monitors all users' home directories (i.e. anything
under ~, for all users) for encrypted files. Thus if the ransomware
encrypts files outside these directories, RansomWhere? may fail to
detect and block it.

It is allowed to run and install as it is signed by Apple and trusts:

Trust
RansomWhere? explicitly trusts binaries signed by Apple proper
(though not ones signed with an Apple developer ID). As such, if
ransomware abuses an signed Apple binary (or process, perhaps via
injection), RansomWhere? would not detect this. Moreover, the tool
inherently trusts applications that are already present on the system
when it is installed. Thus is ransomware is already present on the
system (before RansomWhere? is installed), it may not be detected.

Now this is fine and likely good as the premise is:

Let's try to generically thwart OS X ransomware via math!

Now the question is: "Could a similar application be developed for Windows?"
It seems that there is application/process whitelisting done where a baseline is established during the installation. But there is the rather significant addition of being able to trust signed installs, is that doable on Windows?

Already done - it's currently in beta.

Have a look at: Malwarebytes Anti Ransomware Beta.

Former times it was called CryptoMonitor developed by EasySync Solutions, owned by Nathan Scott. Nathan was recently hired to bring up the Anti Ransomware tool for Malwarebytes.


Exact difference CSRF vs. DNS Rebinding attacks I am currently studying CSRF and DNS Rebinding attacks and I am wondering what the exact difference is. As far as I understand, DNS rebinding is way to bypass CORS and thus get information from a service that listens on localhost that an attacker would not get otherwise. CSRF however only allows an attacker to trick the user into performing a certain actions on a service that listens on localhost, but would not allow for any information extraction (because that would be prevented by CORS). Is that correct?

Also, what are protection mechanism to prevent CSRF vs DNS rebinding? CSRF can be prevented by anti-csrf tokens: Is that also a countermeasure against DNS rebinding?

CSRF and DNS rebinding are basically both cross-site request, but done differently and targeted against different protection mechanisms.

With CSRF the browser is aware that this is a cross-site request. This means that the Same Origin Policy will be applied. Thus, the request will be executed and will usually also include the cookies for the target site (i.e. kind of authenticated) but the attacker will not be able to read the response.

With DNS rebinding the browser is not aware that this is a cross-site request since the DNS name stays the same and only the target IP address changes. This means that no Same Origin Policy will be applied and thus the attacker can read the response. But, the browser will also not send any credentials and cookies for the real target server since it accesses the server with a different domain name than usual (the attacker controlled name instead of the real domain name) - and credentials and cookies are bound to a domain and not an IP address. This means that the request will not be authenticated automatically.

CSRF tokens will help in both cases since the attacker does not have access to the proper tokens. In case of CSRF it also helps if the servers checks the origin of the request (i.e. Referer and Origin header) while in case of DNS rebinding the server should verify that the value of the Host header is actually the server itself instead of an attacker-controlled domain.


How does an attacker abuse Facebook Connect with a leaked secret key? I am reading about Facebook Connect and it looks a lot like OpenID Connect.  Are these two similar enough that the Facebook Connect secret key is an OAuth Client Secret and therefore the same attacks apply?

Or put another way,  what could an attacker do if he stole a Facebook Connect secret key from a web application?

(edit: this is the token in question)

This depends on which key you are reffering to as the "secret key":

The application's secret key, or app secret, allows you to generate an application access token. With this access token, you have full access to the Graph API application object. An attacker who gets hold of your app secret could change all settings from your app dashboard. You should definitely not let this token leave your secured servers.
The access tokens that are granted to your users after authentication can allow an attacker to query the Graph API in the same way your app can. Facebook wouldn't know the difference. The possible impact of such an attack would depend on the permissions your app requires.


Certificate Issuer is Network Company I simply want to know if is this normal, abnormal, deceptive, illegal, etc...

I am at work. When I bring up a certificate for most domains, I get a very standard certificate. When I bring one up for Facebook or Twitter (social media sites), the certificate throws a warning. The warning is because they are untrusted. Looking at the certificate, the Issuer is the company that runs the local network in our building. It is not a standard issuer.

This is exactly how it is listed (replacing the company name with xxx.com):

Issuer: DC=com, DC=xxx, CN=XXXsubCA

Some companies are very concerned about information leaking onto social media sites. Because of this, they will put in proxies that inspect the content of data sent to social media. When they do this, they issue their own certificate, and it behaves in the way that you describe.

Is it normal? Not for the average user, but increasingly normal in corporate environments

Is it deceptive? Sort of, but you might have been notified of this kind of thing in a corporate policy

Is it illegal? That really depends on your jurisdiction. But, as I said, it is becoming increasingly common, and in many jurisdictions is legal (with or without notification).

The other question you need to ask is, "what is my risk?" And here it is: Because they are interested in the content of what you post, it is likely that they store, inspect, and alert on that content. That means that everything you post goes to your company. All communication (to those sites) is no longer private to you and your intended audience, but is exposed to those who are authorized to view such information in your company.


Protecting websites from outdated browsers and plugins via a whitelist/blacklist combination? Aside from using browser headers, I want to blacklist/whitelist browser and plugins from my site so that I can prevent these older unpatched systems from (1) being a general user of my site (2) removing those 'targets' from would-be-attackers reach.

  My goal is to define some kind of
  endpoint security standard for users
  who access my site, but without
  directly managing the environment, as
  they are customers.

Is there a standard way to use Whitelisting or Blacklisting to control browser access to my site?

For example, I want to prevent any browser that has outdated Flash, but I want to permit them if they have no Flash at all.

First off: This is absolutely the wrong way to solve CSRF problems.  CSRF vulnerabilities are a problem in your site, not in the browser.  Blacklisting certain browsers is not going to solve your CSRF vulnerabilities.  CSRF is not browser-specific and cannot be prevented through browser blacklisting.

Detecting browser versions: There are various ways to detect what browser version and plugin versions the user is using.  For browser version, you can use the User Agent.  For Flash, you can use the Flash player detection kit.  For Java, see Sun's java update check.  You'll want to check Quicktime, too, but I'm not sure how to do that.  Note, however, that detection of the browser version and plugin versions is difficult in Internet Explorer.

Knowing which versions are insecure: Maintaining the list of known-vulnerable browser and plugin versions is more difficult.  I think it's probably too much work to reasonably expect an ordinary site to maintain.  For browsers, a partial starting point is Yahoo's list of A-grade browsers, but they don't maintain which version is the latest known-good version and which versions are known to have vulnerabilities.

Suggestions: If you must check for outdated/vulnerable browser and plugin versions, I suggest that you look closely at  the Mozilla plugin check website, which checks whether you have any obsolete or vulnerable plugin version installed.  It supports Firefox, Safari, Chrome, and Opera, and partially supports IE.  You might want to copy or use their methods.  See also Mozilla's JSON interface to their plugin version database.

Bottom-line recommendation: I think you're asking the wrong question.  I think your question has some hidden assumptions and premises that are faulty.  Browser blacklisting is not an effective way of fixing or mitigating CSRF vulnerabilities.  And I think the question is unclear on the threat model.  I suggest that you re-ask the question afresh, this time starting with the actual problem you are trying to solve and the constraints you are working within, rather than making assumptions about what the best solution is (e.g., assuming that browser blacklisting is the best solution).


ASA VTI NAT policy options I am using a virtual tunnel interface to connect my ASA to a router in order to use BGP between the two.

The inside network on the ASA (10.10.10.0/24) needs to use source NAT to make it appear to the router that 10.10.10.0/24 traffic it is in fact coming from 10.99.99.0/24.

I need to apply this source NAT in such a way that it doesn't compete with the Internet access based PAT translation policy for this same inside network: 10.10.10.0/24.

I could certainly define the source NAT rule to only apply when bound to specific destination networks (towards the router), but is it possible to configure some sort of policy so the ASA to only triggers the source NAT for traffic that needs to go across the VTI?

It turns out that the nameif identification of interfaces, which can be used to "name" a VTI cannot be used in NAT statements.  So, instead of being able to use source NAT like

  nat (inside,outside) source static (real_subnet) (translated subnet)

I have to use twice NAT with any,any statements like this

  nat(any,any) source static (real_subnet) (translated subnet) destination static (real_subnet) (translated subnet)


Does password protected git public key protect my repository? When generating my public key for GIT access, I decided to set up a password for it. My push procedure looks like this now:

Enter passphrase for key '/c/Users/USERNAME/.ssh/id_rsa':
Counting objects: X, done.
Delta compression using up to 8 threads.
Compressing objects: 100% (X/X), done.
Writing objects: 100% (X/X), XXXX bytes | 0 bytes/s, done.
Total X (delta 3), reused 0 (delta 0)
To git@github.com:Username/reponame.git
   XXXXX..XXXXXX  branch-name -> branch-name

Does this passphrase really protect anyone for pushing to github, or can this be bypassed?

The passphrase is used to encrypt the private key, which prevents it from being used to digitally sign commits. This protects your private key from being abused by an attacker if it becomes compromised (e.g. you accidentally commit your private key to a public repo) unless they can crack your password.


GPG key expired on mykeyring, but still valid on keyserver Can someone help me in explaining this:

I have an old and expired GPG key, on my keyring the key lists correctly as expired:

myself@mypc:~$ gpg --list-sig --fingerprint DDF70E72
pub   1024D/DDF70E72 2010-12-01 [expired: 2015-01-01]
      Key fingerprint = 2D26 5D20 103A 16D6 4561  E107 D4B2 92C0 DDF7 0E72
uid                  My Name (4 apr 1965) <mymail@mydomain>
sig 3        DDF70E72 2014-11-29  My Name (4 apr 1965) <mymail@mydomain>
sig          2D4527DC 2010-12-25  [User ID not found]
sig 3        DDF70E72 2010-12-01  My Name (4 apr 1965) <mymail@mydomain>

While on keyserver the key appears as not expired:

Search results for '0xddf70e72'

Type bits/keyID     cr. time   exp time   key expir

pub  1024D/DDF70E72 2010-12-01
     Fingerprint=2D26 5D20 103A 16D6 4561  E107 D4B2 92C0 DDF7 0E72

uid My Name (4 apr 1965) <mymail@mydomain>
sig  sig3  DDF70E72 2010-12-01 __________ 2015-01-01 [selfsig]
sig  sig   2D4527DC 2010-12-25 __________ __________ []
sig  sig3  DDF70E72 2014-11-29 __________ 2015-01-01 [selfsig]

sub  2048g/D40BC0B4 2010-12-01
sig sbind  DDF70E72 2010-12-01 __________ 2015-01-01 []

Can someone help me in understanding why?

Have you tried pushing your updated key to the keyserver?  The main reason that your copy of the key and the one on a keyserver would differ is that you changed the expiration date of your key on your local machine after pushing it to the keyserver.  See https://www.gnupg.org/gph/en/manual/x457.html for help if you need to update a key.  Once you update the key on the keyserver, the keyserver should begin distributing the updated key to users looking for your key.

Alternatively, if you no longer wish to use that key, you could revoke the key and publish a revocation certificate to the keyserver.


Certificate Pinning for WebSockets I have seen many implementations of certificate pinning for HTTPS connections originated from client-side apps running on mobile devices using native libraries and plugins.

I would like to know whether such certificate pinning implementations are available for websockets. In the client side (say a mobile device or web browser), can we actually implement certificate pinning for websockets?

If such approach is available, it would be really nice to have an explanation, ideally with links to resources/ articles/ code snippets/ libraries.

Securing secure websockets
Secure Websockets start life as a standard HTTPS request and only connect if a valid HTTPS connection can be established with the server.  As a result, websockets will automatically respect any public key pinning, strict transport policies, etc, which the server sets in the response headers when the client first attempts to establish a websocket connection.
Therefore, for web browsers, it's simply a matter of providing a standard Public-Key-Pins header.  I couldn't say how it works for mobile clients.  It may vary from platform-to-platform, but it wouldn't surprise me if many simply follow the same security headers as browsers.
A Caveat
Note though that you may not want to actually bother with public key pinning, as it seems that support for it is waning or even already gone.  The trouble with public key pinning is that it is one of the only security measures that can literally lock people out of your website in a way that cannot be fixed, as has happened to businesses.
Understanding Websockets
You linked to an article which discusses the fact that you cannot set request/response headers over a websocket connection.  This is true, but it also doesn't change my above answer.  The article is actually talking about something different, although it is a common source of misunderstanding (I ran into the same question myself when I enabled authentication on my first websocket server and client).  To explain though it's important to understand the lifecycle of a websocket request:

The client sends a standard HTTP request to the server with a special UPGRADE header.
The server sees the header and sends a response letting the client know it accepts the request to upgrade to a new protocol
Having been officially upgraded, the client and server both keep the original TCP connection open and send data back and forth through it directly as needed

Your article is referring to step 3 of this process.  Once the websocket connection has been established, you can no longer send request or response headers because there are no longer HTTP requests being sent.  Instead the client and server exchange data directly over the TCP connection in whatever format they want.
However, the initial attempt to establish the websocket connection still happens over a standard HTTP request and requires a standard HTTP request to be properly established.  As a result, the browser should still respect any response headers sent back down by the websocket server when initially establishing a connection.  And indeed, the server can send additional headers back down at that phase of the process.


Best practices for operating a Bitcoin-Qt client regarding netwok privacy? As privacy is part of security, I know there is a Bitcoin SE here but they couldn't answer my question so I hope it's appropriate to ask it here.

I don't ask about how to secure my wallet on my drive, but purely from a privacy and hence security standpoint on the network. For example I don't understand if I run through Bitcoin traffic through a VPN/proxy or TOR, will it add to my privacy or security? As the traffic will be more unique, obscured, not just like 'average" traffic on the net.

I couldn't really find more info on the topic. I just want that my wallet couldn't be associated with my person.

It might do. Running traffic through tor helps to protect your privacy but there are quite some pitfalls.

Read the tor warning page for some basic ideas. In essence your biggest risks are:

human error: eg. if you created this stackexchange account without tor, or you ever used it without tor, or in some other questions you reveal information about yourself -> in this case certain people/police might know that you have a milion dollar bitcoin wallet (or at least know/prove that you claim so) or you buy services that might lead to you using your wallet (this is probably the biggest risk because there are only so many useful things that are completely anonymous (you can't change to real money anonymously easily, you can't buy a car or a house or something that will be send to you by mail, etc).
software bypassing tor: if your bitcoin client uses some sneaky way to obtain your real ip address and it communicates it over the net, tor won't help you
software uses unencrypted data transfer. Note that tor exit nodes can read whatever is passing under their nose, unless you encrypt end to end, like ssh or https. They shouldn't be able to get your real ip address, but they can read and change content (say if your bitcoin client had a buffer overflow vulnerability, they could run arbitrary code on your computer) Note that running a tor exit node is quite easy for anyone to do, whereas the government might be able to spy your internet connection with help of your ISP, but for a random individual that is more difficult.
time analysis: If you are a suspect and both your internet connection and that of the bitcoin service you use are under surveillance, a network packet of a specific size leaving from your computer and a packet of the same size arriving shortly after at the server, or the other way round might establish a suspicion that you are communicating with that service.

Note that their are services to help anonymize bitcoins.


What are the risks in using a VPN tunnel I live in a small town and I know my ISP in person. I don't like the idea he can read all my unsecured communication (if he wanted to do so).
I know I can use a VPN tunnel such as SecurityKISS.com to hide my communication from him.

Are there any risks in doing so? Am I going to draw attention to myself as a potential terrorist, child pornography consumer or something similar which I am not?

If the VPN is untrustworthy they can read your traffic instead of your ISP. Whether that's an improvement or not is up to you really! Can't say I've heard of the one you linked, and this isn't the place for product recommendations, but have a shop around for a trustworthy VPN provider. Or alternatively pick up a cheap VPS (a server you can run yourself) and follow a guide to set up a VPN service on there, and have your own private one.


What is Cryptographic metadata I'm learning about how to encrypt a file in a computer system.

I'm reading this: https://wiki.archlinux.org/index.php/disk_encryption

Here I found an notation: Cryptographic metadata.

As I know, each file has its inode (https://en.wikipedia.org/wiki/Inode), which includes the metadata of the file.

Now the link above tells me that the tool eCryptfs puts the cryptographic metadata in the header of each encrypted file.

I don't quite understand what it means.

Cryptographic metadata is information needed to encrypt/decrypt the data itself.

For example, when using AES-CTR mode, you need a nonce and counter. This information is not sensitive and can be stored alongside the file, in this case as extra information in the filesystem.

The link you mention has a whole section on cryptographic metadata. They also store:

encrypted master key
data-encryption-key (per file or per-directory)

So just like metadata is information about the data itself (filename, timestamps, permissions, etc...) cryptographic metadata is anything needed to perform cryptographic operations on the data.

As for the "header" part, eCryptfs stores metadata in the same logical file, before the actual data. Eg: if I encrypt the following file:

| this is my plaintext data |

It will be stored as follows on eCryptfs:

| metadata | cipher text of the data |

The advantage of such a method is that the encryption metadata lives in the same place as the file, so moving the raw file (underlying eCryptfs) carries its encryption information.

You can find more information about the implementation details in this paper.


hundreds of users creating mail.ru and projectgold.ru accounts on my application db I am working on Ubuntu Server with mysql installed, I have a forum application vbulletin 5 installed and there are hundreds of mail.ru and projectgold.ru created on my application, it looks like this:

each user also creating random post like this:

Every time I am deleting all the users from my database, a few minutes later it will generate the same user, so deleting the users doen't fix the problem.

I don't have basic security knowledge, I am searching on forums but no clue, I have scanned my server using chkrootkit and clamscan but no infected files found, maybe you guys have any clue on what should I check, is this related to malware? or maybe there are hidden scripts planted on my server?

This is the access.log:

[20/Aug/2017:07:40:25 +0000] "GET /forum/peraturan-forum/peraturan-forum/1346-lars-hjalte-potros-and-mine-boss-rwanda/ HTTP/1.0" 301 0 "http://forum.afi.festiware.com/forum/peraturan-forum/peraturan-forum/1346-lars-hjalte-potros-and-mine-boss-rwanda/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:53.0) Gecko/20100101 Firefox/53.0"

We are using chaptcha on registration form.

Here are the Vbulletin recommendations:

(Before reading the quotation below, try to enable reCaptcha V2 as @Mirsad said.)

  Most people are being hit with a lot of spam these days. Some things
  you can do to reduce this are:

  Moderate new registrations Admin CP -> Setting -> Options -> User Registration Options -> Moderate New Members -> Yes
  Activate email verification Admin CP -> Settings -> Options -> User Registration Options -> Verify Email address in Registration
  Upgrade to at least vBulletin version 3.7 or higher. These versions have several Human Verification Options. Admin CP -> Settings -> Human
  Verification Manager ->

  Image Verification:  This is the same Images Verification Captcha as
  in older versions of vB, except that this now requires both GD and
  Freetype 2 to be installed in PHP.

  Question and Answer Verification This allows you to set up a Question
  and Answer verification during registration. If done correctly it will
  be almost impossible for bots to enter the correct answer.

  reCAPTCHA™ Verification This uses the reCaptcha service. You will need
  to register with them and get both a Public and Private key.

  * Note: As per this announcement, we recommend using the Q&A method with multiple questions. * After you have chosen the method you want
  to use and have set this up, then make sure the correct Human
  Verification options are set here: Admin CP -> Settings -> Human
  Verification Options

  And if you have chosen the Image Verification option then you need to
  choose either GD or ImageMagick here: Admin CP -> Settings -> Options
  -> Image Settings You can go back to the Human Verification Manager to make sure the image is showing correctly.

  Note: Both are equivalent. These are also required if you use
  thumbnails for attachments or wish to automatically resize pictures
  that are too large.

  Ban 'free' email domains many spammers use. Admin CP -> Settings -> Options -> User Banning Options -> Banned Email Addresses

  See this thread for a list of commonly banned email addresses:
  http://www.vbulletin.com/forum/showthread.php?t=148061

  Set these options for the Unregistered, Users Awaiting and COPPA usergroups: Admin CP -> Usergroups -> Usergroup Manager -> Edit ->
  Can Use Email to Friend -> No Can Email Members -> No

  Require Human Verification on Configured Actions -> Yes

  Add a new required question to registration. Although there is a Q&A option in the Human Verification Manager, at this time these is no
  way to use this in conjunction with Image Verification or reCaptcha.
  However there is a workaround for this. You can create a required
  profile field to add Q&A to the registration process. To do so, follow
  these instructions: Add an extra question to the registration to
  prevent bot registrations.
  Restrict Email to Friend to Registered Users. Some people have reported that spammers are using the 'Send Email to Friend' function
  to spam others from your forums. To reduce this make sure that your
  Unregistered, COPPA and User's Awaiting groups have the 'Can Use Email
  to Friend' option set to 'No'.
  Stop bots spamming through the Contact Us link. Admin CP -> Settings -> Options -> Human Verification Options -> Check 'Contact
  Us' and 'Register'
  Enabling Spam Management. vBulletin supports managing spam through the Akismet and Typepad Anti-spam services. Both services require an
  API key to use. Here is how to obtain those keys.

  Akismet - To obtain an Akismet key, you need to sign up for a
  Wordpress.com account. This will give you a key to use within
  vBulletin. After signing up please see this page for instructions on
  retrieving your key: http://faq.wordpress.com/2005/10/19/api-key/

  Typepad - Typepad also requires a key to be used. To get one go to
  this link here: http://antispam.typepad.com/info/get-api-key.html

  Once you have your key, you need to enter it into your vBulletin
  Options under: Admin CP -> Settings -> Options -> vBulletin Options ->
  Spam Management -> vBulletin Anti-Spam Key Powered by Akismet

  Note: Either key goes into the same spot. On the same page set
  'Anti-Spam Service' to the appropriate service. You can only use one
  service at a time.

  Note: Because of recent spam attacks, we strongly recommend that you
  combine one of the Image Verification options along with a Q&A as
  described in item #6 above.

  In addition banning free email accounts (#4) will be a major help as
  well.

source


Access documents on internal network with website securely I have a large document store of client data on my internal network. I am  in the process of engaging some developers to build a website to make this data available to my clients externally. I also want my clients to be able to upload new documents that will get put into the same file store.

I have created a front end DMZ for my website, a back end DMZ for my website DB, and I have my internal network where my files are stored. Each layer is separated by firewalls.

How should I securely deliver the files to the FE website?

Should I create a web service on the FE web server that can access the internal network for the files?
Should I create a web service on a server in the BE DMZ that can access the internal network for the files?
Should I create a web service on the internal network that can grab and deliver the files, and enable the FE website to talk to that web service on a set port?

Any other way I should be doing it?

I am looking for the most secure method, as the client data is very sensitive to my business

You for sure do not want to expose the FE webserver to access the internal network. If someone pops your FE box, then they'll have access to your internal network. I would also not give your BE DMZ access to the internal network directly. I would install an SSH server on your BE DMZ that is only available to your internal network and then I would transfer the files from the internal network to the BE DMZ over SSH. You'll also want to protect the data in a secure area on your BE DMZ system using encryption at rest as well as TLS for over the wire.


Intermediate CA authenticity in an embedded device My company are using an offline embedded device, that must encrypt connections to its client (a PC connected with USB).
We have chosen to use TLS with both PC and device authentification to encrypt messages, and use certificates to secure the system.
So the device needs to send CSR and receives its certificates to authenticate and secure connection.
Also, It needs to store the root certificate of my company.
These certificates will not be downloaded directly from the internet, the client PC will act as a proxy and relay them to the device.
My question is how I can validate that the intermediate CA is authentic (that was created only by my company).

My guess was to use the Organisation or Common Name of the CA that can be identified with the company name.
And use the CA certificates chain to validate that the CA is not self-signed.

But could it be possible to create a CA cert with valid chain certs and with the same name as my company in Organisation or CN field?
For example, an intermediate CA cert that has the same common name but different parent authorities (Verisign, Let's Encrypt...)
Are there other ways to authenticate intermediate CA?

Thank you for reading this message, and for your answers.

Being a CA means that there is a great deal of trust placed in them.  The global CAs present in your browser and OS all follow the CA/Browser Forum rules regarding who they will issue certificates to, how they validate clients, and what kinds of permissions they'll allow on certificates.  Very specifically, a global CA will not issue anyone a certificate with the KeyUsage field permitting either keyCertSign or cRLSign.  This means you cannot create your own intermediate CA signed by Verisign, because that would allow you to forge certificates for anyone on the planet. Verisign would lose their global CA status quickly if they issued signing certificates to their clients.
To use client certificates the way you're describing, your organization has to have your own private PKI and distribute your own organization's trusted CA root certificate to all participants.  Your PKI is then free do do whatever you need, such as issue an intermediate CA a certificate that can sign client certificate requests.  But just like trusting the global CAs, you must place a lot of trust in your private PKI, espeically to not sign inappropriate requests.
Larger organizations that run their own private PKI will often use a certificate request management system that serves as a protective front end to their signing CAs.  This system's job is to authenticate that certificate signing requests (CSRs) come only from authorized consumers; it ensures that incoming CSRs don't request inappropriate permissions; that CSRs all follow corporate policies and standards for every field; and they'll keep an inventory of all issued certificates (which can come in handy if you need to know when certificates in your organization are about to expire.)
Your PKI team would rely on such a system to not issue Subordinate CA signing permissions to anyone but the PKI team.  This would prevent a client from generating a rogue intermediate CA.  And that's what prevents the scenario you describe.


Internet browsing encryption I have a shared wifi point with a person who might be interested in knowing what I am browsing, writing and downloading in the internet. This person is the master of this wifi network, only he has an access to all the settings etc. The guy previously was a system administrator, knows quite a bit of programming, had hacking as a hobby in youth times. Being aware of this possible leakage, I purchased this Hotspot shield thing. I wonder if I'm really on the safe side?

When using Hotspot you are protected by strong encryption (128-bit key). Attacking that encryption is effectively impossible. So consider your data sent via Hotspot secure.

If someone is really trying to attack your connection, they will likely have better luck attacking your devices than your network connection. Be sure to have strong passwords on your devices and always apply security patches as soon as possible.


Security Administrator Windows Roles I find that security administrators often need to perform vulnerability checks on systems and these tasks need at least domain or local administrative rights. Does the security administrator need full domain admin rights or maybe just a power user? What is the best practice in regards to assigning windows roles to a security admin?
thanks

A security administrator shouldn't need to have any access to any system within a production environment and certainly not any administrative access. Their function needs to be logically separate and independent to the roles of those users who perform administrative functions.

A security administrator should be able to run vulnerability scans, have access to review patching levels, anti-virus configuration, standard configuration information, review security logs etc. Each of these should be available through the production of reports from management systems or through application interfaces which can be presented to that user.


Partial Man on the End Security The Situation: I'm developing a script that runs in a popular sandbox game as a paid service for other developers. The problem is that the game does not implement a way to do so. The language is Lua and the game has disabled bytecode loading. This means that any script I hand over to the other developers would have to be executable code.

The Threat Model: The developers can access and modify the script's source code. They can setup servers to run scripts on their own computer or on the game owner's server. All scripts run on a server, and never on the player's computer.

Current Solution: My code can load string source code and contact an external server through HTTP. I think that my best bet is to contact the external server who can check which type of server I'm running on and deny access if the request isn't from a official game server. I trust the official game servers. Once this is done my script can run the service transmitted to it.

If developers can edit my source code and in order to run the service I need a string to load, what is to stop the developer from printing the string right before I run it? I could use all the white box cryptography I want, but that endpoint of loading a string is still vulnerable. Do any of you security experts have an answer or experience on projects like this?

You can achieve your goals with two methods:

offload logic into servers controlled by you. Lots of games do this already.
obfuscate your code. You can use XFuscator, for example.

However, with 2, its impossible to be 100% secure. Preventing people from actually running your code by themselfes and not a server is actually quite impossible.


Seeking advice on how to build a box to brute force hashes? I work in a startup security firm, and I need to build a GPU-based to brute force password/hashes, which can be used to validate password strength and test hashing algorithms. I expect some high processing demand, so it needs to be a high spec.

What (detailed) configuration do you recommend?

Would it be better to invest in a massive 1k+ cores CUDA/OpenCL GPU or to build a cluster of less-costly cards? Is "mining hardware" like these a good option?

Update due to answers: Due to customer requirements I can't outsource this to EC2 or similar cloud solutions.

I am assuming you are already familiar with hashcat for the software aspect:

http://hashcat.net/oclhashcat-plus/

On the main page they have some system information, check the forums and wiki too. You might want to look into professional graphics cards and figure out what configuration works best. You might want to get some cheaper cpus across multiple boxes and distribute the workload.

http://golubev.com/gpuest.htm
[Placeholder for a link to a site I have to find again, but that had a good build guide]


Is it not safe to open MySQL's port to the internet? The consensus on this Server Fault question seems to be that opening port 3306 for MySQL is more dangerous than using an SSH tunnel to access MySQL.

I would think that with strong credentials you could keep MySQL safe, especially since the login can be locked down to certain hosts in the USERS table.

Is there something about a MySQL connection that is more insecure than SSH, or is there a risk that connections attempts attacking 3306 could somehow overwhelm the database?

If it's not needed, it should be closed.

Vulnerabilities

You can never be sure if there are no vulnerabilities in MySQL itself. Here is an example for a DOS attack (and it's not the only possible attack).

Allowing non-ip restricted remote access to MySQL

Allowing remote access to MySQL is not a vulnerability by itself, but there are scenarios where it can be used in combination with other vulnerabilities.

For example, lets say the site exposes a config file: Anybody could read the database connection credentials.
If an attacker can also connect to the database remotely, some or all data is compromised (and other attacks might be possible as well, for example code execution if into outfile is allowed).
But if remote connection is not possible, the attacker can do very little with this information (assuming the password is not used somewhere else - eg ssh - as well).

The exposed config file is only an example. For another example consider blind sql injection: retrieving the database password is relatively quick, but retrieving the entire database would take a whole lot of requests. So being able to connect remotely to it would be quite useful.

Allowing ip restricted remote access to MySQL

(This is just speculation) It seems that you can connect to MySQL using udp, so ip spoofing is possible. I could imagine that any attack not needing direct feedback (as for example writing code into a file via into outfile) might work this way (providing that the database credentials are acquired).

Encryption

It should also be considered that ssh is encrypted by default, while MySQL is not (and the setup doesn't seem all too easy). This means that most users will use an insecure connection if direct access to MySQL is provided.