How will Apple and Google provide 5-minute data on Covid exposures using 10-minute interval numbers in the hash? The goal of COVID-19 exposure notification is to notify people that they were exposed to someone who later tested positive for the virus. Protecting privacy in this process requires some cryptography, and avoiding excessively granular detail on user locations. But providing data useful for disease prevention requires adequate detail in measuring the length of exposures.

There is a new API for such exposure notification from Apple and Google, but it has a tension between 5- and 10-minute numbers that I don't see how to resolve.

The cryptography specification, v1.2.1, specifies 10-minute intervals as inputs to the hash: "in this protocol, the time is discretized in 10 minute intervals that are enumerated starting from Unix Epoch Time. ENIntervalNumber allows conversion of the current time to a number representing the interval it’s in."

Meanwhile the FAQ, v1.1, specifies 5-minute increments in the output: "Public health authorities will set a minimum threshold for time spent together, such that a user needs to be within Bluetooth range for at least 5 minutes to register a match. If the contact is longer than 5 minutes, the system will report time in increments of 5 minutes up to a maximum of 30 minutes to ensure privacy."

How will the system report times in 5-minute increments when the interval numbers are only updated for the hash once every 10 minutes?

While the actual SDK code is not available, we can make an educated guess that the ENIntervalNumber is NOT used to calculate the duration of contact.
Let's step back a minute from the crypto to describe what's actually happening on a person's phone. This is documented here, but to give a quick summary:

Alice who has enabled the app is scanning for bluetooth broadcasts sampling every 5 mins.

The scanning strategy that works best is opportunistic (leveraging existing wakes and scan windows) and with minimum periodic sampling every 5 minutes.

Bob who has also enabled the app is broadcasting over bluetooth with data containing their Rolling Proximity Identifier (RPI).

Alice's phone detects Bob's broadcast and saves the RPI and metadata. This data is timestamped.

Scan results shall be timestamped and RSSI-captured per broadcast.

Later when Bob is diagnosed a set of his Temporary Key and ENInterval numbers are send to the diagnosis server that pushes this information to all clients.

Alice's phone receives this information and calculates the RPIs and matches against those stored on her phone. Locally the distance and duration of contact are calculated.

Given that we've got the timestamp and the RPI from step3 it's likely that the calculation of duration is done by simply comparing the timestamps. This will also ensure that the distance and duration data is not revealed to the server or other clients.


Build and execute code on a sandboxed environment? Numerous websites allow us to build and execute C code from web browsers (repl.it, onlinegdb.com, ideone.com...). For my own application (education purposes) I would like to do the same on my web backend.
My current solution is to use an Alpine Docker container with gcc constrained with ulimits. To avoid mounting files I simply use gcc in stdin/stdout with :
protected $container = "frolvlad/alpine-gcc";
protected $cc = "gcc";
protected $cflags = "--static -std=c99 -Wall -pedantic";

protected $ulimit = [
    'locks' => 10,
    'sigpending' => 100,
    'rttime' => 1,
    'nproc' => 1,
    'nofile' => 50,
    'msgqueue' => 1000,
    'core' => 1,
    'cpu' => 2,
    'fsize' => 1000000,
    'memlock' => 1000,
];

protected function execute($cmd, $args=[], $stdin=null, $env=[])
{
    $descriptorspec = [
        0 => ["pipe", "r"],  // stdin
        1 => ["pipe", "w"],  // stdout
        2 => ["pipe", "w"],  // stderr
    ];

    $cwd = '/tmp';
    $ulimits = $this->getUlimitOptions();
    $docker = "docker run --stop-timeout 1 -i --rm $ulimits $this->container";

    $process = proc_open("$docker $cmd", $descriptorspec, $pipes, $cwd, $env);

    if (is_resource($process)) {
        if ($stdin) {
            fwrite($pipes[0], $stdin);
            fclose($pipes[0]);
        }

        $stdout = stream_get_contents($pipes[1]);
        fclose($pipes[1]);

        $stderr = stream_get_contents($pipes[2]);
        fclose($pipes[2]);

        $exit_status = proc_get_status($process)['exitcode'];
    }

    return (object)[
        'stdout' => $stdout,
        'stderr' => $stderr,
        'exit_status' => $exit_status
    ];
}

public function build($code, $args=[])
{
    return $this->execute("$this->cc -xc $this->cflags -o/dev/fd/1 -", $args, $code);
}

The execution is done the same with
public function run($executable, $args=[])
{
    return $this->execute("cat > a.out && chmod +x a.out && timeout 1 ./a.out", $args, $executable);
}

Would this solution be secure enough and what would be the possible improvements?
Of course, the backend API is throttled, and only authenticated users can access the build interface.
Obviously codes such as the following would be still an issue:
#include <stdio.h>
int main() {
    while(1) printf("hello, world!\\n");
}

As for the infinity loop scenario you can actually:

Limit the resources granted per container.
Assign the maximum execution time allowed. Optionally kill the container if someone uses 100% of assigned resources for too long (you should monitor the use of assigned processing time).
You can monitor the prcesses in the deployed containers for any strange patterns.

As for the security, it is as safe as your sandbox is, you should be at lookout for any escaping technics and vurnebilities related to that.


Database Security - Encryption & Searching I am completely new to cryptography but have been trying to make myself familiar with the concepts and applications. I have a project where I believe cryptography to be beneficial.

Project Info:

DB = MySQL 5.6

Engine = InnoDB

My application will reside on an intranet web server behind a network firewall with a very small white-list. Few users of this application will have the ability to add/remove values from the database. A larger number of users would be able to read these values. Values I would hope to encrypt could include:

emails
account numbers
paths
dates
unique ids

Largest table(s) would have up to 150k entries and total sessions likely to remain under 100.

Being an intranet site I assume (with limited security knowledge) that my primary threats will be malicious users, hardware theft, and persistent XSS from an internal or external source. I am doing my best to mitigate all of these.

Doing some research on how to encrypt my data while allowing it to be searchable leaves me with a few options (please correct wrong information);

CipherSweet Blind Indexing: requires library, may be overkill, false positives possible
MySQL AES_ENCRYPT/DECRYPT: if logs are compromised plaintext values will also be compromised
Application Side: runtime "nightmare", heavy load, could cause issues with multiple threads running

Questions

While ugly and poor practice should application side encryption/decryption be acceptable for my environment?
Would the likelihood of false positives with CipherSweet be negligible for my datasets?
Given my environment, would letting MySQL handle the encryption/decryption be acceptable (neglecting hardware theft or server compromise)
Bonus - should I be worrying about external XSS given my environment

I understand this question may fall into the category of discussion and if that is the case please direct me to where I may find further information to narrow my questions.

EDIT

I am now also exploring the possibilities of using CryptDB or TDE.

EDIT 2

I am working with MySQL Community Edition so it seems TDE will not be available to me unless there is a way to specifically acquire only this feature. Continuing to research other options. Any information is appreciated.

EDIT 3
For my OS I dont think I will be able to use CryptDB as in its docs it says:

  Requirements: > Ubuntu 12.04, 13.04; Not tested on a different OS.

For the threats you mentioned the encryption of database is not really necessary.

malicious users is a too broad definition. What threats do you expect? For instance, if you mean a threat that the user finds a way to get more privileges in the application than you assigned him or a threat that the user can impersonate him as some other user, then he will get the data that the application provides him, i.e. unencrypted data. Database with data encryption will not change anything.
persistent XSS protection has nothing to do with database encryption. If your XSS protection fails, then the application will execute the malicious action triggered by XSS just like any other action of the user. It does not matter if the database is encrypted or not.
hardware theft is more complicated. If the attacker can boot the OS and if the file system is not protected, then the attacker can put malicious code or crack your application code, launch your application and via application get access to the encrypted data, or even directly get access to data via database API. I would suggest you use an encrypted file system instead and to protect booting (and thus decryption) with a password. And when you create backups (database, configuration, maybe logs), encrypt them, too. Then the usage of encrypted DB will not give much additional security, whereas it will cost you much overhead. That's why you can use any normal database.


Why my files that Encrypted with EFS in Windows 8.1 shown in Linux ubuntu? i Encrypted my files with EFS in windows 8.1

so

i logged in ubuntu and without any warning , its shown my files

actually not Exactly the file

but shown the path of file and the name

and i can enter to the folder that Encrypted with EFS , In other words the green folder , I can get into the green folder.

but i do not have access to files

how can I prevent from entering the folder, the green folder(that encrypted with efs) with another os???like ubuntu???

thanks

This is normal. It's how EFS works.

Although it is common to refer to file folders with the encryption attribute set as “encrypted,” the folder itself is not encrypted. When encryption is set for a folder, EFS automatically encrypts all new files created in the folder and all files copied or moved into the folder by using My Computer.

(Source: Microsoft TechNet: Using Encrypting File System) (Archived here.)
You may want to use full disk encryption like TrueCrpyt or Microsoft's own BitLocker instead of EFS.
EFS ZIPs
Edit: EFS-encrypted ZIP files are a quick and dirty workaround.

File names in encrypted folder are not protected. Actually, encrypting folder contents means automatically applying encryption to all files in the folder, not encrypting directory data itself.
Since the file name itself could contain sensitive information, it could be a breach in security. One of the solutions would be using encrypted .zip archives instead of folders, which are treated by Windows XP almost like folders. Thus, only one file is needed to be encrypted and archived data themselves are harder to crack.

(Source: NTFS.com: EFS - Encrypting File System. Encrypted Files and Folders
(NTFS v. 3.0 and newer) (Archived here.))


Yahoo Email Keeps Getting Phished I keep getting spam emails from myself (and I am sending them to others as well) on my Yahoo Mail account. I have already went through two password changes which I thought were secure. My very last one had 14 characters (although it consisted of two dictionary words) and a symbol. Is it just a case of my password consistently being cracked, or is something else going on?

There are a number of things that could cause your account to be hijacked.
Generally speaking an insecure password is not high on the list unless its been taken from a site that was recently hacked. To prevent against this, make sure you do NOT reuse passwords on different sites.

What's more likely is that your computer has some kind of malware installed on it and is key-logging your passwords whenever you change them.
In the case of spammers it's rare for them to manually target your account specifically (by say trying to reset your password using recovery questions etc).

I'd suggest using two factor authentication to sign into you email if you use a service like gmail that supports it.

I'd also suggest you check your computer for viruses/malware and ensure that any other devices you regularly log into (home/work/school etc PC's) are scanned as well.

Finally, its possible that someone might be intercepting un-encrypted login traffic if you are signing into something like hotmail where SSL isn't enabled by default. It's worth ensuring that your wifi traffic is encrypted and that users on any wired connection are trustworthy.

With any luck, one of the above recommendations will solve your problems.
Good luck!

Edit: As rory has suggested, your account may be spoofed and not actually compromised. Check your outbox/sent items to see if the email has indeed come from you. It might also be worth while checking the mail headers to see if it comes from your network or from somewhere else.


CSRF tokens for a JWT-auth system using cookies I think I have this sorted, but would love to hear if I'm wrong. We have a Python+Angular.js set of apps, which are using JWT tokens for authentication, where the tokens are encrypted using a secret key, the payload identifies the user, and the token is stored client side in a cookie set as HTTP ONLY and as secure. For a variety of reasons this works well for us, we get to use one Python wsgi middleware app across multiple API backends, our token gets sent automatically on every request to the domain, and we get to bypass using sessions entirely. I've had this part checked out on here and elsewhere and I'm confident it's good.
( my question on that is here: http_only for cookies with JWT tokens )

My new question is how to handle CSRF tokens, given that we are not using sessions at all. I am thinking the following:

auth is handled off the jwt token in the cookie described above, let's call it accept_token_cookie. JS can't read it, it's HTTP ONLY. Has the user id.
a second cookie is sent with our CSRF token, which is not HTTP_ONLY, thus angular can read it (let's call it csrf_cookie)
csrf_cookies payload is an encryption of our identity payload (or part of it, like user email), but made with a second secret key
when an XHR request is made, my JS will look at the csrf_cookie value, and add it to a header
on ingress, our server decodes both cookies and gets the token as sent by angular in a custom header. If these do not all match, we know this request is bad because the requesting javascript couldn't read our csrf_cookie. However, csrf_cookie is still not used at all to generate identity, which is what we want so that the accept_token cookie remains totally opaque to the client.

From all my reading, the above sounds correct. If I'm wrong, please tell me why, thanks.

when an XHR request is made, my JS will look at the csrf_cookie value, and add it to a header

If you are not using CORS and you are checking this header server-side then this alone will be enough to mitigate CSRF.

The reason is that custom headers cannot be sent cross-domain without CORS.

Setting and checking the actual token value helps further because any vulnerabilities present in plugins (e.g. Flash) that may help bypass the custom header restriction cannot be leveraged to bypass your protection.

See here for using custom headers as a CSRF mitigation.

Your approach seems like a variation of the Encrypted Token Pattern.


Is suspend-to-ram really a meaningful risk for Full Disk Encryption? Ubuntu offers full disk encryption relying on luks. An often recurring area of criticism is the fact that Ubuntu disables hibernation by default while suspend-to-ram stores the private keys in the ram memory. However I wonder if this risk is meaningful in practice.

If your laptop is locked (ie showing the login screen), or the lid of your laptop is closed (and your laptop is configured to wake up on the lock screen). How could someone inspect the content of your RAM without having to reboot your computer?

It seems to me that on the one hand, the attacker cannot switch to single-user mode without rebooting. He cannot even mount an usb key containing a bruteforce script since he does not have mount rights. Similarly he cannot open a shell under your user (or any other user) since your computer is locked.

So my question is, is there a piece of hardware I am unaware of that would allow the content of the RAM to be inspected in an hot manner without needing to power the device off to make hardware modifications?

The scenario I have in mind is the one of a determined adversary stealing a laptop.

There seems to be hardware able to read the RAM, Tribble card and a couple of US gobernment related companies do produce similar devices source.

So yes, it could be possible, but it is very unlikely that regular thefts would have access to such a specific hardware.


How does a polymorphic virus identify whether it's already infected a file? If a virus usually recognizes itself via a signature, but the virus changes every time it replicates, how can the virus identify if a file is already infected to avoid re-infecting? It seems like any clear signature would just ruin the point of polymorphism in the first place.

All viruses are different, and operate in various ways. There is no one blanket solution in which a virus detects whether it has infected a file or device yet. If this were the case, it would make the job of the anti-virus quite easy wouldn't it? So as such, there are several different solutions to your question.
A quick note on terminology: Malware is defined as any type of malicious software. A virus is defined as a type of malware which replicates itself by modifying other computer programs and inserting its own code (as per Wikipedia). So a virus is a subclass of malware. There are also several different types of viruses: file resident viruses, memory resident viruses, boot sector viruses, and macro viruses.
Since you asked specifically about viruses that infect files, we will only look at file resident viruses.
File Resident Viruses
These will be looking to install itself into executable files, or programs. This is because other files, like text documents or photos, aren't interpreted as code by the machine, and the virus payload needs to be interpreted as instructions. When a virus infects an executable and writes to the binary, it will either overwrite the preexisting code, tack its code on the end, place its code at the beginning, or install its code into 'cavities' (empty spaces in the binary that are filled with NULL characters, or NOOPs).
Once a file is infected, the virus needs to somehow later recognize it. Some viruses are coded to be dumb, and will just reinfect the file. This could mean either the virus code is overwritten by the same virus code (or a slightly altered version) leading to no real change, or the file just keeps getting bigger because the virus keeps tacking onto the existing executable. The smarter versions of viruses will implement methods to recognize their spawn.
One way a virus can tell if an executable has been infected is via tagging. When writing it's code into a binary, the virus will place a value in a specific spot. Every time a virus attempts to infect an executable, it checks that spot for the value. If it's there, it doesn't infect.
A simple example: a virus might modify the first byte of a program to read 0xFF. If it sees 0xFF as the first byte of a file (even if that file isn't infected and just happens to have it's first byte as 0xFF) it won't infect it.
A more complex example: The virus uses an algorithm similar to how a hash works. It takes in the file name and generates a byte value and placement for that value, then writes that byte to that placement. Since it uses a hashing style algorithm, the same byte and placement will be generated given the same file name, so it wouldn't change. This makes it harder to identify an infection.
Another interesting idea would be that the virus creates a special data file hidden on the machine, which lists the executables it has infected. The file location could be static or generated. If the file isn't found, the virus would assume the system hasn't been infected at all yet.
Really any system you can think of could be a possible way that a piece of malware identifies it's infected spawn. There's no rules revolving around this sort of thing, all that matters is if it works. Some methods will end up being better than others though, depending on what the attacker is trying to achieve.
Polymorphic vs Metamorphic viruses
I won't go into lengthy details on the difference between the two, but it's important to know that a Metamorphic virus rewrites it's own code to avoid detection, where as a Polymorphic virus encrypts or encodes itself to make it appear different. In other words, with Polymorphic viruses, not all of the code changes. Some of the code (namely the decryption algorithm) stays the same with each iteration. In this sense, the fingerprint only partially changes, and the virus could search for the static portions of it's code that don't change, to recognize an infected executable.
Also, a Polymorphic virus only has a finite number of permutations. If this number is reasonably small, it could store the keys to all other possible permutations inside of the encrypted portion of its code. That way, it can decrypt all infections and recognize itself. This probably isn't the best option, since if one virus is decrypted by researchers, all permutations will be uncovered, but it's definitely a solution.
As for Metamorphic Viruses, it's even more complex, but they would be stuck using some sort of tagging system like previously defined. In these cases, it might even turn out that two different metamorphic strains of the same virus don't recognize each other, and install themselves over the other, leading to a war between the two strains (lol). But this could be said for any virus which holds a bug in the identification portion of it's code.


What is mutation XSS (mXSS)? I was unable to find any good documentation or anything on mXSS. Can anyone give some info or give a link?

I found a video and a PDF of the video's presentation:

http://www.youtube.com/watch?v=Haum9UpIQzU

https://hackinparis.com/data/slides/2013/slidesmarioheiderich.pdf

mXSS is a new type of XSS attack by Mario Heiderich. I actually saw him present this very talk at Syscan 2013 this year.

The vulnerability in question comes from innerHTML which allows direct manipulation of HTML content, bypassing the DOM. An elements innerHTML is non-idempotent. The browser manipulates the contents to fix and optimize errors with the HTML. This is very visible in the example given in the slides. The problem with this manipulation is that it sometimes introduces flaws that is not apparent at first sight. One good example is also in the slides.

The big deal about this attack is that it bypasses (at the time of the talk, situation may be better now) most of the existing XSS filters and sanitizers.

As far as I know, there isn't any other available information about this class of XSS attack besides whatever information is present in the presentation slides.


Get info of computer (logged in username) secretly using USB drive I have a scenario in which I have to do a social engineering exercise for a client. The exercise is the simple old free USB trick, but the catch here is that I have to only get only the (non damaging) info of the computer/user who inserts the USB and not directly access their system which can be done using the Social Engineering Toolkit available in Backtrack.

Any idea or suggestions on how I could do it?

As you probably know,

  The SET Infectious Media Generator creates an autorun.inf file and a Metasploit payload Source.

Since you don't want to use the Metasploit payload, you can simply create an autorun file and a Powershell script for information gathering. There are different types of information you may want to collect, from the logged on user to the MAC address and so on.

A more sophisticated attack (which would probably require additional permissions) would involve dumping the RAM of the targeted user and looking for particular strings, such as password. I'm not an expert in this topic, but this might be done by using tools which are typically used in live forensics.


Is it possible to make an output of an encryption algorithm more susceptible to cryptoanalysis by altering input? For example (very simplified one) usually encryption/decryption works like this:

encrypted_data = encrypt(data, key)
data = decrypt(encrypted_data, key)

I wonder, if it is possible to modify input data so that the function encrypt would become reversible without the key (here the modification is denoted as +x):

encrypted_data = encrypt(data+x, key)
data = modified_decrypt(encrypted_data , x)

What I mean by the modification is: maybe it is possible to do with an addition of some repeating pattern to the input data, or may be by permutation, or may be by finding specific x as a function of data...

If it is, then how? If it's not, why?

I know, it would be specific to an encryption algorithm. So I need to know, if this is possible with any popular encryption algorithm?

P.S. possible applications are: data recovery after such viruses as wannacry, or an identification of an informational leakages in organizations, etc.

What you describe is termed a chosen-plaintext attack, or CPA. All good, modern ciphers are not at all vulnerable to CPA. In particular, the US standard cipher AES is not vulnerable to this attack or any of its variations. Any cipher which is vulnerable to this is typically considered to be badly broken.


Why is key exchange necessary at all? Let's say "Alice" and "Bob" want to communicate with each other over an insecure network.

Using Diffie–Hellman key exchange, they can get the same symmetric key at last. However, as I understand, they do not have to get the same symmetric key at all, because they can just use asymmetric key without key exchange.

With RSA algorithm, Alice and Bob can just share their public keys (public_a, public_b) and keep their private keys (private_a, private_b). Alice can just send Bob the messages which are encrypted by public_b, and Bob can decrypted it by private_b. They can still communicate over an insecure network, without Diffie–Hellman key exchange at all.

I know I might be wrong, but I'm not sure where I was wrong. Does anyone have ideas about why and when Diffie–Hellman key exchange (or any key exchange)  is necessary? Is it suitable for the situation I mentioned above?

If the attacker is able to passively capture data and later gets access to the private key of the certificates (i.e. stealing, heartbleed attack or law enforcement), then the attacker could decode all previously captured data if the encryption key is only derived from the certificate itself.

DH key exchange makes it possible to create a key independent from the certificate. This way knowledge of the certificate alone is not enough to decode previously captured data. This is called forward secrecy. See Wikipedia for more information.

Apart from getting forward secrecy with DH there are other reasons to use symmetric cryptography instead of simply using the RSA private keys. Thus even if you don't use DH for key exchange TLS will create a symmetric key, which is then derived from the certificate. For more details why using the private key directly to encrypt is not a good idea see Why does PGP use symmetric encryption and RSA?.


Is it possible to hide behind a hostname to purposefully effect SEO? Reference forum questions and a couple answers posted on 10 December 2014

What are these unknown visits to my private, unlisted webpage?

One of the answers contained this phrase: "Given the fact that they are hitting your page with another host name..."

Here is my delimna.  I have 2 websites, one that is about 1.5 years old and the other that is about 6 months old.  The problem in the original question submitted is an item that I have seen on my sites, but in huge numbers.  So much so that it has caused my SEO to be nonexistent and I can no longer be found on google period. For example from 8 Dec till today, there were 46 of these sessions from Russia on just one site, the newest one.  It's almost as if someone is purposefully attempting to cause my bounce rate to be the 80 percent plus that it has become.

I don't even know how to approach this problem.

The older website, I haven't cared so much about as it was a website that I was putting together. I never really noticed or started studying the problem through Google Analytics until a month back, which caused me to go look at my other site. I started looking and and making some comparisons.  The behavior is the same and has been sustained and consistent and thus I have to believe it is somehow purposeful.  Is that possible?

I found this site because I typed in the service provider of "hosting telesystems network" in Moscow. This is just one example as I see other places in SE Asia showing the same behavior.  Again, consistent and sustained.  I need some help big time before I decide to build another site and run into the same issue.

Are the hits from a small set of locations? In particular, a smallish set of IP addresses?

If so, why not just block the connections?

I regularly get unsavoury connection attempts from various locations and I have scripts in place to auto-ban the IP addresses.

Indeed, depending on the nature of the site, you might be better off simply banning whole countries!

By banning, the originating IP cannot access the web site, doesn't trigger analytics and doesn't show up in any Google stats.


DoS by consuming all hosting trafic Given a small website hosted on a small data plan, is it possible for someone to keep doing requesting for my website URL or just an image hosted on my website that will consume all my permitted traffic and make the host eventually close access to the website?

Or do hosts have a mechanism to defend against this?

This kind of DoS attack it actually very easy to carry on and it could be as simple or as sophisticated as it get: it can be a simple as a wget scripted loop, a spam campain using images hosted on your server, etc.

It is usually very easy to carry out because the resource attacked is usually quite small and can easily be completely consumed in a short time, even with limited bandwidth.

Note also that it can also happen without anyone deliberately attacking you: having a resource hosted on your site growing in popularity unexpectedly will have the same result (see slashdot effect some something similar).

Defending against this is actually rather easy, at least for everything that is static content (usually most of your site): you put a content delivery network in front of your web site and they will reduce drastically the effect of such attack against your site (many also offer other services too and they come in all kind of prices from free to awfully expensive).


Website allowing different accounts with same username I am doing an audit on a website, and discovered that you could create different accounts with the same username, but different passwords.

an user 'a' with password 'a' will have a different account than user 'a', but with password 'b'.

I have the feeling that this behavior is wrong, but I don't clearly see what is the risk in doing so.

There is no account recovery system on the website for now.
login failure says "wrong username or password", so it doesn't disclose existing users.

Could you explain me what are the risks of providing this behavior?

This behavior suggests that the passwords are not stored in a correct way.

Presumably the website you audit looks up users in a database, matching both the fields username and password. This means that the password is not hashed, or hashed in a predictable way. If all passwords had a different salt, the lookup function would have to check every password in the database. This can only be done in a reasonable time when using a very fast hash function, which is a bad idea when storing passwords.

So the passwords are either not hashed, hashed without salt, or hashed with a very fast hash function. This is not optimal, since it is recommended to hash passwords using salts and a slow hash function, such as bcrypt.


Tools to produce an MD5 collision? I'd like to learn a bit more about MD5 collisions.
So let's assume I have a message m:

m = somesecretmessage

And I hash that message:

z = md5(m)

The only know information is z. I do not know m.
How would I be able to generate a file/string that would result in the same md5 hash as z? Also would it be easier if the length of m was known?

After some research it seems finding a collision is very feasible (aka in a couple of minutes/seconds). How would I create such a collision - a file/word that gives me the same hash? What tools can I use to achieve that?

This is not a collision attack, but a preimage attack

With a collision attack, the attacker has control over both inputs to the hash function, say x and y, and they want to find x and y such that x ≠ y but h(x) = h(y).

With a first preimage attack, the attacker knows h(x) but not x, and they want to find y such that h(y) = h(x).  Importantly, the attacker cannot change x.

If the message were known, it would be a second preimage attack, where the attacker knows x (and therefore also knows h(x)), and wants to find y where y ≠ x but h(y) = h(x). Again, the attacker cannot change x.

MD5 is still secure against both first and second preimage attacks, so what you want to do is not possible, and knowing the length of the message (or even the entire message) will not help.


Windows PFX certificate import: protect private key using virtualization-based security? On Windows 10 v1803 (i.e. April 2018 update) when importing a PFX, an option like

[ ] Protect private key using virtualization-based security (non-exportable)

appears on the import wizard. What is the underlying technology and it's mechanics from security perspective?

Virtualized-Based Security (VBS) uses TPM module to store keys. The key is accessible from within OS, but won't be available if OS is changed. More details on VBS: https://docs.microsoft.com/en-us/windows-hardware/design/device-experiences/oem-vbs


Preventing control-flow attacks by storing code in ROM I was wondering why storing entire program in ROM doesn't prevent buffer-overflow, return-to-libc attacks ?

Is the code still loaded in RAM before executing which makes it vulnerable to control-flow attack ? (if that's the case why aren't code pages marked as read-only by MMU ? )

Oups, there are different points in your question...

Why is not the code for libc of other program stored in ROM?
By definition ROM is read only, that means that it would be impossible to upgrade libc nor any program if is were stored in ROM

Why are not code pages marked as read-only at MMU level?
They are marked as read-only. Unfortunately it has no use against buffer-overflow, return-to-libc attacks

What makes those attacks possible?
The return address is not stored in code, but in the stack. All current languages (past mid 60s Fortran 4...) also store local variables in stack to allow multithreading and recursion. That means that is a program has no special stack protection and you overflow a local buffer, you could theorically rewrite the return address and that way execute arbitrary libc code.

It must be noticed that most current compilers now implement special stack protections to mitigate those threats.


Advantages of TLS-SRP when the secret must be exchanged online? I've got some practical questions about SRP when the shared secret must be established online.

Is there a way to establish the shared secret online without the use of HTTPS?
If you've already used HTTPS to establish the shared secret, why bother with TLS-SRP at all? Meaning, what's the advantage of switching to TLS-SRP if you already trust HTTPS?
https://security.stackexchange.com/a/2531/5002 claims that "SRP stores the password on the server in a non-recoverable [...] way." What prevents an attacker from figuring out the user's password using a brute-force attack in the same way we attack databases that store password hashes?

SRP is for situations where you already have a shared secret between client and server, e.g. as part of a "pairing" procedure which would occur naturally in your context (for instance, SRP has been proposed for Bluetooth peripherals: one device has a screen and displays a code, the other device has a keypad on which the code is entered). For a "fully online" situation where there never is any occasion to obtain such a shared secret, SRP has little advantage. Security has to start somewhere.

In SRP, what the server stores is indeed a sort-of hash of the password -- only "sort-of" because the stored value must also fulfil some mathematical structure so that it can be used in the protocol. That value cannot be immediately used to authenticate as a client, but, like any hashed password, it is indeed susceptible to brute force. The magic of SRP is that observing data packets on the wire is not sufficient to apply a dictionary attack on the password; however, what the server stores allows such an attack (and, in a very general way, this is unavoidable).

In TLS/SRP as currently specified, the value stored on the server is computed as:

    x = SHA1(s | SHA1(I | ":" | P))
    v = g^x % N

where s is the salt, I the user name, P the password, and v is that which is stored (x is not stored). g and N are SRP parameters (public). If the attacker can obtain the value v, then he can "try passwords" by doing the computation above.

This is a salted hash (that's good), but it is also a quite fast hash (that's bad). SRP could be coupled with a good password hashing function (e.g. bcrypt), with the following caveats:

There is no specified or de facto standard for that. But both client and server must agree on the particular.
If slow hashing is used, then, when a connection is performed, it must occur on the client, not on the server. So this will run at the speed of the client.


Snort rules to detect Meterpreter sessions I am learning while configuring Snort, my setup consists in an attacker (Linux), a victim (Android smartphone) and one detection system (IDS). So far, I have been able to log all the packets between the attacker and victim including the Meterpreter session. What should I do/research about if I want to detect the Meterpreter session? A little bit of packet analysis gave me a hex value for the stager. The payload used is android/meterpreter/reverse_tcp.

I want to make a rule file for detecting a Meterpreter session between those two devices. How should I proceed? It would really be helpful if someone points me in the right direction. Thanks!

I know this is an old question, but searching I found this interesting post. There are the hints you need. Extracted from there

You can do as Snort rule to detect Meterpreter sessions for external connections. I mean, reverse Meterpreter shells trying to connect to outside. Doing this:

alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"Metasploit Meterpreter"; flow:to_server,established; content:"RECV"; http_client_body; depth:4; fast_pattern; isdataat:!0,relative; urilen:23<>24,norm; content:"POST"; pcre:"/^\/[a-z0-9]{4,5}_[a-z0-9]{16}\/$/Ui"; classtype:trojan-activity; reference:url,blog.didierstevens.com/2015/05/11/detecting-network-traffic-from-metasploits-meterpreter-reverse-http-module/; sid:1618008; rev:1;)

For other kind of scenario changes should be done on the rule, but is a beginning.


Are WPA2 connections with a shared key secure? This is something that has been bugging me for quite some time: when I have a wifi access point with WPA2 encryption and I give out the key, how secure are the connections? With WEP you could easily decrypt all packets using the same key, but with WPA2 I'm not sure. Are all individual connections still secure?

So, this question is not about accessing the network, but about eavesdropping on individual wifi connections within the network.

Anyone who witnesses the association process of a new client can eavesdrop on their connection.

As reassociations can be forced by a rogue host that sends a forged disassociation packet in the name of the target, it is practically always possible to listen in on all connections on a WPA(2) network with a preshared key.

You can even try it for yourself in Wireshark: There is a built-in option to decrypt all transmissions in the 802.11 settings; as long as you know the PSK and the initial authentication is contained in the recorded traffic, Wireshark decrypts it automatically for you.

The difference between WEP and WPA is that there is a different pairwise key (called the pairwise transient key) for every client, but as this key is always directly derived from the PSK, it doesn't really add any security at all. If you want that kind of security, you would have to use EAP and a RADIUS server (sometimes called "WPA enterprise), where the PMK is different for every client.


How do the following key formats rate in being more secure to less secure: RSA, ECDSA, ED25519 In examining the available information on the network, I see an amount of conflicting information concerning the RSA, ECDSA and ED25519 key formats.

I understand that RSA is the most universal at present.

From my reading it looks like in order of security provided, the order is from most to least secure is:  ED25519, RSA, ECDSA.

Am I not understanding something here?

I am not looking as to when to use it rather I'm looking for a ranking based on the security of the key.  Currently I use a LONG RSA key (>4096 bits).

"Which is more secure" is not the best question to ask.  All of them are sufficiently secure as long as:

They are implemented and used correctly;
They're used with a sufficiently large key size.

ECDSA and Ed25519 are based on elliptic curves.  Their advantage is that they can achieve the same security target with shorter keys than RSA requires, which translates to better performance.  256-bit elliptic curve keys are generally understood to provide similar security to 128-bit symmetric ciphers like AES-128.  With RSA, 2,048-bit keys are considered the current minimum safe key size, providing something like 112-bit security (which no less secure in practice than 128-bit security).

The KeyLength site has various recommendations for key size for these algorithms.

Ed25519 is newer than ECDSA.  Its main advantages are speed, simplicity and foolproofing: both are secure if used correctly, but ECDSA is harder to use correctly.  The most famous ECDSA failure is the Sony PS3 signature bug, which was caused because Sony's programmers implemented ECDSA incorrectly.  Ed25519 is not vulnerable to the mistake Sony's programmers made, nor to some other "gotchas" that ECDSA implementations are.

So Ed25519 is widely held to be the best of the three, because it provides:

Sufficient security for the near future.  (All three will be toast if a practical quantum computer is built.)
Very good foolproofing—less vulnerable to programmer and user mistakes;
Smaller keys and very fast performance.

...but none of these factors should stop you from using ECDSA or RSA if, for example, you're using a system where one of these is available but Ed25519 isn't.  Likewise if you have a system that uses RSA or ECDSA, it probably doesn't make sense to upgrade it to Ed25519.  Also RSA and ECDSA has NIST and NSA approval and Ed25519 doesn't, so if that matters to you then Ed25519 is out.


What are the security threats when Googling and surfing when my Gmail account is open? Suppose I log to my Gmail account. After that, I use Google to search for random websites and visit some.

Are there any security threats on my Gmail account when Googling and surfing the net while it is open ?

This picture, hopefully, explains what I mean:

Your gmail account will be safe unless someone finds a Cross-Site Request Forgery (CSRF) vuln in gmail.

While nothing is 100% secure in the world, Google has proved to be very good at defending against security vulnerabilities. Even if a vulnerability is discovered, there is a good chance that it will be patched quickly. I rate it as highly unlikely that your account will be compromised in this manner.


Secure crossdomain for rtmp/flash streaming/wowza I've been a bit lost. I have the following situation:

Flash Player file is on https://sub.example.com/player.swf

crossdomain.xml is on https://sub2.example.com/crossdomain.xml

Streaming is done using Wowza.

The crossdomain.xml right now is everything but tight:

<cross-domain-policy>
  <allow-access-from domain="*" secure="false"/>
  <site-control permitted-cross-domain-policies="all"/>
</cross-domain-policy>

I've tried to figure this out myself and have read the following posts about this:

http://sethsec.blogspot.ch/2014/03/exploiting-misconfigured-crossdomainxml.html
https://stackoverflow.com/questions/1215127/how-do-i-specify-a-crossdomain-policy-file-to-allow-flash-to-grab-a-bitmap-from
(especially answer two)
https://forums.adobe.com/thread/422391
https://www.wowza.com/forums/showthread.php?45081-The-function-of-crossdomain-xml
https://www.adobe.com/devnet-docs/acrobatetk/tools/AppSec/xdomain.html

Still my question remains and is:
How should the crossdomain.xml look like in this case to protect properly and why? There are no reasons other players should access the stream besides player.swf on the different subdomain.

A properly locked down policy would look like this in your situation:

<cross-domain-policy>
  <allow-access-from domain="sub.example.com" secure="true"/>
  <site-control permitted-cross-domain-policies="all"/>
</cross-domain-policy>

Allowing * wildcard for all domains means that user sessions on sub2.example.com could be compromised by a malicious Flash app on another domain that the users visits.


What did the certificate authority do with my CSR? I needed to reach a web service which is not mine.

The IT department of that web service has asked me to send them a CSR (certificate signing request).
Then, he will send me back a signed certificate which I can include in my calls with PHP by combining that certificate with my private key.

What did the certificate authority do to allow me to do this? How does the webservice now accept my calls? Can someone describe to me step by step what they have done?

A CSR is a file that contains your public key and the data that describes your server -- such as its hostname ("common name"),etc. A certificate authority (CA) is an intermediary that you and the parties you connect to mutually trust. A CA will review the CSR you submit and then issue a certificate, which is usually the same data as in the CSR plus CA's own digital signature. When you offer this certificate to servers you connect to, they check to make sure that the CA signature is valid and belongs to a CA they trust. This simplifies the procedure of assuring trust between parties by placing it into a "mutually trusted authority."

I suggest you search for terms like "what is a certificate signing request" and read some introductory articles on x509 public key infrastructure.


Should 2FA over SMS be considered insecure in the wake of recent SS7 attacks? Design flaws related to SS7 has been known to us for quite a while now but telcos have conveniently discarded the arguments saying that the risk is too low due to the significant investments required for performing the attack. But considering the recent news that hackers have performed a real world SS7 attack to bypass 2FA and siphon off funds, it is pretty clear that the return of investment in these attacks will cover for the costs.

Should we, as application developers and pen testers consider SMS based 2FA as a weakness?

The newest draft of the NIST Digital Identity Guidelines deprecates the usage of Two Factor Authentication via SMS.

I would recommend utilizing Google Authenticator (or similar technology) to facilitate 2FA moving forward, and abandon SMS based out of band verification.


External hard drive's hardware vulnerabilities You have an external hard drive that was left in a public place. The data is encrypted.

What are the hardware or software vulnerabilities one can use to get the encryption password when one decrypts it?
is it possible to find out if the hard drive's software or hardware was modified with those vulnerabilities and is safe to use?

These are good questions to be asking. Unfortunately, the answer is pretty much “???” to both.

To the first question, individual vulnerabilities vary by drive. As with all technology, vulnerabilities exist out of mistakes in implementation or design, so there are no universal rules for knowing what something might be vulnerable to. To illustrate this, using an appsec example (I specialize in appsec, so it’s always on my mind) - just because something is a login form doesn’t mean it’s vulnerable to cred stuffing attacks. Sure, that’s a good vector for cred stuffing, but the form might be rate-limited, use sophisticated banning techniques, etc. You can’t know simply based on the fact it’s a login form.

Similarly, just because something is an external hard drive doesn’t mean that its encryption is or is not compromised. To get more information over this, you’ll need to research the drive you plan on using more. As a result, without knowing the tech and its vulnerabilities, the answer to your second point is even more unknown.

However, as a rule, the safest bet is to assume that anything left unattended in public is fully compromised. This level of paranoia/caution might be unwarranted (i.e., leaving an encrypted drive for 5 minutes while you turned your back at the library seems probably fine), but if you want maximum security, that’s the best way to go. This is especially true in a higher-risk situation - such as if the drive is old and therefore maybe less secure, if it was in an environment with more resources (the library is probably less likely to have compromise than, say, in custody with law enforcement), etc. If it really really matters, assume it’s toast and act accordingly.

I’m going to add the caveat this is just Internet Thoughts. Have common sense and don’t make decisions based off of this, knowing this answer is written from the perspective of broad generic guidelines.


How to pass both passphrase and password in GPG signed symmetric encryption? I am new to GPG so I may be going about this all wrong.  I have some files I would like to encrypt symmetrically using AES256, but I want to sign them with my GPG key.  I need to automate this process however so I'm using --batch and I pass the symmetric key after --passphrase.  Since it needs to be automated, I've disabled passphrase caching by following the steps here.  However, this means my script has no way to pass in the passphrase for my GPG private key.  My script will be piping the files to gpg so passing the passphrase to gpg via stdin is also not an option.
If there is no reasonable way to pass both the AES password and private key passphrase, I might consider doing this in two steps, with gpg symmetrically encrypting and then a second round of gpg for signing.  It seems excessive though, considering gpg can clearly do this in one step if one passes the private key passphrase interactively.
For reference, I'm using gpg2 exclusively and don't care about backwards compatibility with gpg 1.x.
Here is the command I'm currently using for encryption.  It encrypts and signs as expected, but I can only pass it the private key's passphrase interactively in the text-based dialog "window".
gpg2 --batch --passphrase <my-long-symmetric-password> --sign --symmetric --cipher-algo AES256 plaintext.txt

I found I was going about this all wrong and I found gpg-preset-passphrase, which seems to be for prepopulating passphrases in gpg-agent, meaning gpg2 won't ask for a passphrase as long as I call gpg-preset-passphrase from my script before running the gpg2 encrypt-and-sign I posted in my question.  Just make sure to start gpg-agent with a very high --max-cache-ttl to be certain the cache won't expire before the script finishes.  After that, running gpg-preset-passphrase --forget is a good idea to make sure the passphrase doesn't stay cached too long.


Are esc_* functions enough safe in WordPress? (like esc_url, esc_attr, esc_title) WordPress has a number of built-in validation/sanitization functions. However, as we see, there are two kinds of such group:

sanitize_* (like sanitize_key, sanitize_title, ...)
esc_* (like esc_url, esc_attr, ...)

My Question: Are esc_* functions enough safe in WordPress?
I mean, in such cases:

echo '<input type="hidden" name="orderby" value="' . esc_attr( $_REQUEST['search_term'] ) . '" />';

is that safe enough, or we should still use extra sanitization, like:

sanitize_title(esc_attr( $_REQUEST['search_term'] ))

In my opinion these functions and their documentation are pretty clear at which places these functions should be used and what they do. esc_attr escapes attributes in HTML tags and sanitize_title sanitizes the title and removes HTML, PHP etc. Since attributes (for esc_attr) are (only) used inside HTML tags and HTML tags will be removed by sanitize_title it makes no sense to use esc_attr inside sanitize_title: any escaped attributes inside HTML will be removed together with the full HTML tag.

The esc_... and sanitize_... functions itself are secure as long as they are used for the purpose which they were designed for (and which is documented). If one instead tries to use esc_attr to escape a URL etc then this does not match the documented purpose and likely provides not the intended security.


What hardware and or software do I need in order to limit outbound traffic? I have a situation where my users need to be able to access the internet and search engines to be able to perform their jobs. My problem is that I need to prevent them from being able to upload files to the internet through any means. With most sites, even malevolent ones a lot of the time, using https I am guessing that it is not possible to know if a piece of outbound traffic is a file upload or something else. Even if it isn't a file upload, there should only be so much data heading OUT to a search site.

Can anyone give me some suggestions concerning how to solve this problem? I was wondering if there is some device or software that would allow me to set caps on the total bytes a user sends altogether and to any individual domain or IP address and would then slow the traffic down appreciably and send an alarm to someone to find out if there is a good reason for the activity, someone just didn't understand the policy, or perhaps malware is trying to extricate data.

Currently our devices are behind a FortiGate 60E device, but that can be changed.

Fortigate devices, yours will support this, can do Web Content filtering, and site analysis.

https://help.fortinet.com/fos60hlp/60/Content/FortiOS/fortigate-security-profiles/Web_Filter/web_filter_chapter.htm?Highlight=web%20filtering

You can setup firewall rules based on user identities (either by sign-in page or RADIUS to your DC) that rate limit users, or assign them web-filter levels based on groups they're in.

Even better, the Fortigate web filtering can do deep packet inspection, so you can even inspect https sites.


Tor traffic correlation attacks by global adversaries I recently came across a paper called "Users Get Routed: Traffic Correlation on Tor by Realistic Adversaries" (Aaron Johnson et al) ... which seems to be saying that adversaries (like the NSA) that can see large segments of the Internet can relatively easily de-anonymize most Tor traffic:

  "... previous work has thus far only considered adversaries that
  control either a subset of the members of the Tor network, a single
  autonomous system (AS), or a single Internet exchange point (IXP).
  These analyses have missed important characteristics of the network,
  such as that a single organization often controls several
  geographically diverse ASes or IXPs. That organization may have
  malicious intent or undergo coercion, threatening users of all network
  components under its control. Our analysis shows that 80% of all types
  of users may be de-anonymized by a relatively moderate Tor-relay
  adversary within six months. Our results also show that against a
  single AS adversary roughly 100% of users in some common locations are
  de-anonymized within three months (95% in three months for a single
  IXP). Further, we find that an adversary controlling two ASes instead
  of one reduces the median time to the first client de-anonymization by
  an order of magnitude: from over three months to only 1 day for a
  typical web user; and from over three months to roughly one month for
  a BitTorrent user. This clearly shows the dramatic effect an adversary
  that controls multiple ASes can have on security."

Does this mean that Tor is essentially useless for defending against US government surveillance? I feel like I might be misinterpreting the paper, because I would think the Tor Project would go out of their way to make that clear if it was the case (and there is nothing on their website about this) ... Is it really the case that in less than a day the NSA can de-anonymize 80-100% of Tor users?

Can someone explain to me what the practical implications are of this for Tor users who are worried about NSA/FBI surveillance? What kinds of additional steps could be taken to mitigate some of these threats described here?

Tor doesn't necessarily protect you against a powerful attacker. Section 3.1 of the Tor design document states it:

  A global passive adversary is the most commonly assumed threat when analyzing theoretical anonymity designs. But like all practical low-latency systems, Tor does not protect against such a strong adversary. Instead, we assume an adversary who can observe some fraction of network traffic; who can generate, modify, delete, or delay traffic […]

However if you have a look at the recent leaks there was one about Tor: 'The king of high-secure, low-latency anonymity'. Especially the title of the presentation said it all:

So as far the leaks show it both NSA and GCHQ had a hard time to de-anonymize Tor users. What they basically do is to attack flaws in other systems like Firefox.

If you need a higher level of security you should take a look at special CDs. Tails is one of them. It routes all traffic throught Tor and tries to save you from some known attacks. Also the above mentioned slides write about Tails:

  Adds Severe CNE misery to equation

So it seems that Tails and others might bring you a higher level of anonymity and security against attacks. However if take targeted attacks into the equation you might want to read the documents from Der Spiegel and draw your own conclusions.


Revoked cert not showing revoked in Chrome 64.0.3282.186 As far as I can tell (ssllabs.com / ssldecoder.org) the certificate for www.sarahah.com has been revoked:

Serial  C1:18:2F:1A:91:A9:0E:03

CRL - Revoked on CRL: http://crl.godaddy.com/gdig2s1-792.crl
Revocation date: Mar 1 18:19:00 2018 GMT

OCSP    - REVOKED: http://ocsp.godaddy.com/
Revocation Time: Mar 1 18:19:00 2018 GMT
Revocation Reason: cessationOfOperation

This shows as SEC_ERROR_REVOKED_CERTIFICATE in Firefox 58.0.2, as it should.

However Chrome 64 seems to be perfectly happy with it! Any idea what's going on?

Obviously the hostname resolves to multiple IPs, but behaviour seems consistent in Firefox and Chrome with multiple refreshes.

While Firefox uses OCSP to check for revocation Google Chrome uses CRLsets which include only revocations which are considered to be important by the project - which sadly does not include all revoked certificates. And the site you have visited does not seem to be important enough to be included in the CRLsets.

For a deeper discussion about this problem see An Evaluation of the Effectiveness
of Chrome's CRLSets (2014), Revocation checking and Chrome's CRL (2012) or SSL certificate revocation and how it is broken in practice (2018).


How secure is data at rest on Android/iOS mobile devices We have a need to store security keys on a mobile device, i.e. iOS and Android consumer apps. The app uses those keys in an offline scenario to 'self validate' the signatures of its data. (it can also phone home from time to time to conduct a more robust check)  We're considering how we might store these keys on the mobile device in such a way as that:

They can only be read by our application
They cannot be copied to another device

The obvious places that come to mind are the Android Keystore and the iOS Keychain.  But how secure is this approach from attack?  Some naive Googling indicates a surprising variation of responses to this question; it would be good to try to understand and quantify the effort required to break open these secure storage areas.

The app uses those keys in an offline scenario to 'self validate' the signatures of its data

I'm not sure about the exact circumstances you have in mind, but if your application needs to validate externally provided data, as opposed to data it produced itself, the simplest approach would be to use public key cryptography to sign the data. This way, you'd only need to store the public key on the device, which isn't security critical and doesn't have to be protected (edit: see nolanda's comment for an explanation why this is completely wrong! you do need to protect the public key!)

  But how secure is this approach from attack?

What kind of attack? Are you up against the resources of a nation state, or a lone hacker? What do you know about the underlying devices? Are you trying to protect missile launch codes, or client phone numbers?

Key extraction difficulty from Android Keystore varies; for example, if the underlying device has a hardware security module, it's more difficult to extract the key material from the device than if it's just software-protected.

If your Android device or Apple device has telco capability (e.g. it is a phone), you might be open to attacks from the baseband processor, depending on how well your phone isolates the baseband from the application platform and who your attacker is. So that matters, too.

Without knowing what exactly you're dealing with, it's impossible to give a meaningful answer.

You should also consider that attacking the keystore might not be the easiest attack. The keystore is probably well-secured and flaws in it's security are taken seriously and fixed by the smart guys at Google and Apple. IMO it's more likely that your app has security flaws, and if an attacker gains access to your app, e.g. manages to execute his own code in your app process, he will also be able to use the cryptographic keys to encrypt / decrypt or whathever else you use them for, and it probably won't matter if he can access the key material itself or not, because he can make use of the keys just like your app can.

Another attack might center on the process/app isolation of the Android OS/iOS. Once an attacker manages to breach this isolation, or gains root privileges on your phone, again, he'll very likely be able to make use of the keys wherever they are stored, even if he can't get at the keys themselves.

All that said, I'd add that IMO it's very hard to secure a consumer mobile phone platform and if you're dealing with any kind of really important data (think e-voting systems or systems where human life is at stake), I'd be uncomfortable in trusting such a platform to keep my data safe.


PGP: Can I just upload my public part of encryption sub key to PGP server? I'm a little bit confused here, since the best practice suggests that main key should be completely offline, so which key should I upload to the public directory?

Here's what I have:

main key (sign only)
subkey#1 (sign)
subkey#2 (encryption)
subkey#3 (authentication).

The best practices are to keep your primary private key offline. Your public key is required to be available, as all subkeys, user IDs (and thus certifications) are bound to it.

As you do not upload private keys to key servers anyway, you do not have to care about offline keys at all. You have to upload the primary public key, but could choose from the subkeys (depending on which you want to be available).


Is it safe to load a forensic image which might contain malware? So you get a raw image of a compromised system and then you load it on an application suite like Autopsy. If the system had some kind of malware, could it spread to the operating system in which Autopsy is installed? I mean basically for loading the image, not because there is some vulnerability in the application itself.

It's somewhat safe to load on Autopsy, to dissect it using fwextract, lazarus, and with a bunch of forensics tools, but is not safe to execute anything of it nor open any files from it using the default applications.

It's easy to create a bunch of infected pdf files that will exploit your Adobe Reader, or png files, or whatever. Some files can infect your system if you run strings on it.

To be safe, use a VM to explore a infected system. It's easier to maintain, and you can clean up everything if you mess things up.


NTRU java attack implementation I'm researching NTRU cryptosystem and started research based on source code from sourceforge and bouncy castle(java language).

Currently I'm reseacrhing attacks on NTRU, based on CVP and SVP. But I'd be very grateful if anyone could give me a link to source code of attacks on NTRU, at least on short length, if any exists.

ps. Please don't blame me for not willing to write it all by myself, cause it's rather time-consuming work and there is no reason to duplicate code, if it already exists. would be grateful for any links or pieces of advice.

pps. I've met some misunderstanding on stackoverflow, so I've come here hoping to get any help and understanding

Phong Q. Nguyen, one of the main researchers on attacks on NTRU, uses Victor Shoup's NTL library, which contains an implementation of the LLL algorithm. That's C++, not Java; but this is the kind of number crunching job where the extra efficiency of low-level languages like C++ is handy. 95% of a given application code is not time-critical, and 95% of the remaining 5% is I/O bound (network I/O, disk I/O, RAM bus I/O maybe). Most hardcore crypto jobs (in particular attacks which need a lot of muscle) live in the 0.025% of code where everything happens in CPU L1 cache, and at that place properly optimized C or C++ code is typically 2 to 4 times faster than properly optimized Java code.

Anyway, to understand attacks on NTRU you will need to grasp some rather intricate mathematics, at which point something as trivial as a change of programming language should not bother you.

A good starting point for attacking a cryptosystem is to actually implement it yourself -- having your own implementation is handy if you want to print intermediate values or similar things, but the main reason is pedagogical: the process of implementing the algorithm is what makes you understand how it works, down to its fine details. Reusing existing code will deprive you of all this learning.

(Yes, I wrote that C++ is "low-level". Sue me.)


Digital Forensics and Pentesting: what now? So, i want to enter the security field, and i'm leaning towards security auditing, digital forensics, and reverse engineering.
i'm in school right now, i'm studying x86 ASM, exploring Linux, and soon to be working on understanding exploit development.

i really don't know much about Linux or networking as it is, and i'm interested in taking some SANS courses (incident handling and exploit development http://www.sans.org/security-training/hacker-techniques-exploits-incident-handling-40-mid), and taking their entire path all the way through to help speed up the learning process.

so, i have a few questions:

what do i need to know to take these sorts of classes and actually benefit from them?
what do i need to know before studying for a CEH exam?
how about offensive security certifications?
should i start with the Linux+, Networking+, and Security+ certificates, or is there a more efficient way to learn what i need to know?

thanks!

Edit*
Sorry @ Rory. My main question is this: Exactly what do I need to know to be able to begin the SANS path beginning with the SEC504 course?

I pursued a similar path like this:

Linux+ --> Network+ --> Security+ --> CEH --> Currently studying for CISSP

I have found that they all tie together quite nicely and give a very good overview of important aspects of the INFOSEC field.


Is an encrypted private key which never leaves my home directory more secure than an unencrypted one? On a Linux system I'm running an utility like this:

$ /usr/bin/myapp myprivatekey
Enter passphrase for the private key:...
...application runs and uses the private key

My understanding is that if I have a private key encrypted with a passphrase it is more secure than an unencrypted one because the private key cannot be accessed even if the user account is compromised. So if the private key is loaded by a process running as a different user and the passphrase is typed manually by the user then one cannot intercept the above passphrase. Please note that the /usr/bin/myapp can only be written by root.

On the other hand a colleague argues that, if the user account is compromised then the private key is compromised too even if it's protected by a passphrase, because if the account is compromised then the password typed by the user can be intercepted and one cannot be protect himself in such a situation.

Which one is correct? Is it possible to setup a system such that the private key is protected in the above situation?

Thanks!

Is an encrypted private key which never leaves my home directory more secure than an unencrypted one?

Yes, it is more secure to use an encrypted private key than an unencrypted one.

The argument your colleague gives just shows that an encrypted private key is not completely secure. His argument does not mean that an encrypted private key is no more secure than an unencrypted one. In fact, the opposite is true because the encrypted private key does protect against certain attackers and situtations that the unencrypted key does not. For example, it protects against the situation where you accidentally upload it to your public github account or something. It also protects against a specific type of attacker who only has read access to your directories/files. Because of these types of attacker and situations exist the encrypted private key is more secure.

On the other hand, your colleague is correct that an attacker with local access who can run processes, keystroke recorders, etc on your system could still get your key. However, a local attacker is a very powerful type of attacker and in the presence of such an attacker it is difficult to protect your keys in general.  However, one thing that could be used to protect keys in this situation of local attack is a separate physical factor like an RSA dongle.


Security of email (SMTP/POP) passwords In my client mail app (ThunderBird) I chose (and my mail server accepted) SMTP with STARTTLS, the POP (or POP3) with SSL/TLS. I understand that this is for mail content from my client app to my ISP mail server only.

My question is specifically for the security of this connection to the mail server -  i.e. ThunderBird's connection Security drop-down options are,
No Authentication, Normal Password, Encrypted Password, Kerberos / GSSAPI, NTLM, and OAuth2.  ThunderBird can also probe my Email Server for what it is able to comply or implement on its end. Which I found for my server was only "Normal Password".

So apparently my email server does not offer an encrypted connection and I surmise my password can be seen by someone with sufficient skills. Additionally, I'm curious if there are any email servers (ISP provided or other) that offer Password Encryption.

There are two separate aspects of the configuration here - the connection-level security, and the authentication-level security.  In practice, since connection-level (TLS) protects both, it is common for authentication-level security to be low ("Normal Password").  As long as you're using TLS (SMTP/POP/IMAP either over SSL/TLS or STARTTLS), you're fine.

Why?

Way back, before SSL/TLS/STARTTLS became common, the credentials were the only part of the connection people cared about protecting.  As you say, email may be transmitted unencrypted as soon as it leaves your server - so people were not deeply concerned about the potential for that being read.  However, they were concerned about their credentials.  And those credentials used to pass over an unencrypted SMTP/POP/IMAP link.

For that reason, a number of protocols specially designed to encrypt the credentials were devised.  Digest-MD5, GSSAPI, and OAUTH were all more secure SMTP AUTH methods which could be used over an unencrypted connection.  The more common types PLAIN and LOGIN, which do not encrypt credentials, would leave the password vulnerable if there were no connection-level encryption.

But then the world started encrypting the connection.  SMTP, POP and IMAP clients and servers added support for SSL/TLS or STARTTLS to protect the entire connection.  Once they became common, there was little motivation to use the more complex protected SMTP AUTH methods, because the TLS would provide all the necessary protection.  That's why your ISP is comfortable only offering "Normal Password" (which is PLAIN and/or LOGIN) - they know the TLS layer protects you.

(In fact, some stronger methods weaken security, by requiring that the server store a plaintext or reversibly encrypted copy of each user's password, rather than a one-way hash of it.  To quote Wikipedia on Digest Authentication), "Some servers require passwords to be stored using reversible encryption. However, it is possible to instead store the digested value of the username, realm, and password."  The footnote link for that latter statement goes to RFC 2617 which goes into more detail about the security trade-offs of Digest Authentication...  I've considered implementing Digest Authentication with Postfix, Dovecot, Courier, and Cyrus over the years; each time I decided I didn't like the trade-off.)


Should user IDs be implemented in online banking? How common is it for a bank to request you to make a user ID as well as password when banking?
Should they simply use a pre-determined number such as your credit-card, or are there advantages to have users make IDs?

All the banks I use require me to make a user ID. I believe having an issued ID would be better security, but from a business standpoint you are just making things extremely unpleasant for your users.

I don't think it would be realistic to assign a credit card number as an ID because users could have multiple credit cards or accounts under the same bank, and again the bank wouldn't want to make things difficult for the users. Let's not forget too that everyone would be forced to have very long user names!

Also, you would think that your credit card number is something you want to keep secret as well, but having it as an ID may very well hurt security. Imagine the scenario where someone is lazy and types very slowly(maybe doesn't have a numpad as well). So, this person decides to leave his/her credit card number somewhere and copy paste that when going on the banking site. Well, now it's entirely possible that this person will accidentally post it somewhere else if he/she doesn't remember to copy something else to the clipboard.

All in all it just seems like a lose lose situation


HKDF and key stretching I thought that all key derivation functions would do a key stretching phase, by iterating some kind of process. But I can't see that process in HKDF. HKDF doesn't do key strengthening?

If I have a passphrase as input, and I need, let's say, 1024bytes derived from this passphrase (some bytes for encryption, some bytes for a MAC). What would you recommend? Going directly for PBKDF2? Or using HKDF in some way?

HKDF is a key derivation function: it turns a symmetric key (a bunch of bytes) into another symmetric key, which can be longer (that's the point of the exercise).

Doing multiple inner iterations, to make the function slow, is a defence mechanism which makes sense when the input key is of inherently low entropy -- e.g. when it is a password (that's an unavoidable biological fact: as a storage medium for random-looking data, human brains suck). Deriving a key from a password is a task which is more complex than simply deriving a key from another key. HKDF does not pretend to handle the "password" bit. For that you need PBKDF2, which is password-based (that's the "PB" part) and also uses HMAC, this time with a configurable (and potentially huge) number of iterations.

HKDF is a building block for some cryptographic protocols, not something to use directly.


Can Windows 7 hibernation files be recovered? As curiosity, according to my knowledge, hibernation basically moves memory data from memory to hard disk. First of all, is this true? And if so, is it possible to recover the deleted hibernation data and use it to access memory data before hibernation? So if I hibernate, then wake up, then close an application, then the memory of the application might still be present on the disk?

Also, would it be possible to "boot" using this hibernation data? (So basically force windows to wake up from hibernation by using hibernation data although the system was not put into hibernation)

Answering your questions:

  [...] hibernation basically moves memory data from memory to hard disk. First of all, is this true? And if so, is it possible to recover the deleted hibernation data and use it to access memory data before hibernation?

In a general sense, yes, hibernation copies data from memory, stores it to a disk, turns on some flags on the OS. When you turn the computer on again, the OS sees the "flag", knows that have to read the hibernation data, and proceeds accordingly.

If you can recover the deleted hibernation data, you can know what was in the computer memory before it was hibernated.

  Also, would it be possible to "boot" using this hibernation data? (So basically force windows to wake up from hibernation by using hibernation data although the system was not put into hibernation)

Yes, just depends on the OS you're using, you would just turn the "flag" on and the system would read the hibernation data again.

For further information, take a look at this wikipedia and the corresponding notes.


Is there a security risk using a Symmetric-key for both encryption and HMACing I am proposing to use an AES key to encrypt some data to send to a third party and in a completely separate operation/flow use the same key to create a HMAC of a message to send to the same third party.

I have been told that this is a risk to use the same key for two different things.  I cannot find any information on why this is a risk.  If this is a risk, what is it?

I have found information on this site explaining why you should use different RSA keys pairs for encryption and signing and that makes sense, but nothing on symmetric keys.

Why should one not use the same asymmetric key for encryption as they do for signing?

thanks

The "by the book" approach to this is to use a key-stretching/key-derivation-function to turn a one secret into another (longer) secret. Or two or more secrets. One for HMAC, one AES session key, etc.

This is what TLS does. It expands the master secret into a block of six single other secrets.

I can not name a practical attack if you don't do that.

But stretching the key is cheap. And afterwards you don't have to worry about related primitives attacks anymore. If nothing else, it's a method that allows you to mentally compartmentalize the different crypto parts. It makes the whole construction a lot easier to talk about.


WinHTTP and python requests package, fail to validate certificate containing valid CN but invalid SAN We're using WinHTTP to send API calls from our client. Now according to Common Criteria, FCS_TLSC_EXT.1.2 assurance activity Test 2, if certificate contains a valid CN (common name) but invalid SAN(Subject Alternate Name), the connection should fail.

  Test 2: The evaluator shall present a server certificate that contains a CN
  that matches the reference identifier, contains the SAN extension, but
  does not contain an identifier in the SAN that matches the reference
  identifier. The evaluator shall verify that the connection fails. The
  evaluator shall repeat this test for each supported SAN type.

tool we're using to generate a certificate with valid CN but invalid SAN.

However, with WinHTTP and python requests package, they accept the invalid SAN (which should not happen). There seems to be no documentation on WinHTTP as to how this can be handled. this is internal implementation of WinHTTP.

Internet explorer also fails this test and accepts the connection.
However chrome does deny the connection and confirms that the certificate is invalid (which is the required behavior):

The test fails with python's request library as well.

We are looking for some way if this can be altered to check the issue. Or is this us only facing the issue?

Since both python and windows libraries are used commonly, is this behavior common? Has anyone else experienced this issue?

I want to know if this is how WInHTTP implements SAN check, or is it just our implementation. Also, I couldn't find any documentation on MSDN regarding SAN checking in WinHTTP.

First, the issue is not about valid CN vs. invalid SAN but about a CN matching the domain vs. a SAN not matching the domain. A non-matching SAN is still a valid SAN entry.

The rule according to RFC 6125 is that the CN MUST not be checked if there is a SAN DNS entry. Additionally CN is deprecated for a long time and RFC 6125 explicitly adds that the CN MAY be checked if no appropriately typed SAN records exists and does not require it. Still, most implementations check both SAN and CN. Only Chrome does not check the CN at all since a while now. This is the primary reason the issue seems to be fixed with Chrome but not with others and this actually violates "Verification using the Common Name is required for the purposes of backwards compatibility" from FCS_TLSC_EXT.1.2.

  ... and python requests package, they accept the invalid SAN

As far as I can see the current version of requests ultimately uses the functionality of this ssl module in Python to validate the hostname. The code here in the latest version of Python explicitly makes sure that CN is only checked if no SAN DNS names exist. Of course, this might vary with the unknown version of Python and requests you are using.

  I want to know if this is how WInHTTP implements SAN check, or is it just our implementation

While I cannot be sure because I don't know your implementation the chance is high that at least the version of WinHTTP your are using implements CN checking additionally to SAN - at least by default. This is similar to many other implementations although it does neither match RFC 6125 nor the older RFC 2818.


Where should I put ssl cert (backend or frontend)? I have two applications: One is Backend API and the second is frontend. I want to add SSL certificate.

Both applications are visible via the Internet, one on port x (backend) and another on y (frontend). A client connects to frontend and then frontend connects to backend in order to get data.

Where should I put the certificate on the frontend or backend part?

Ideally, the connections from the Internet to your front-end and the connections from your front-end to back-end both need to be protected using SSL. Whatever is serving your front-end / back-end applications would most likely support SSL termination. Your front-end is most likely served by a web server like Nginx or Apache. You need to get the web server to listen over port 443 and setup SSL there.

If your back-end application is secure and isolated behind a firewall, and if (and only if) it's configured to receive traffic only from your front-end application, you can optionally skip setting up SSL between the applications. This is NOT recommended, however. Certificates are cheap if not free these days and you should aim to set it up wherever possible. There are even performance benefits to this and this lets you use fast, modern transport protocols like HTTP/2 or SPDY.

Depending on your setup, you could even terminate the SSL at the load balancers if you use them. May I ask why your back-end app is open to Internet?


AES, RSA and man in the middle So user A has a huge text that needs to be encrypted and send to user B. User A creates a symmetric key for AES and encrypts the messages with that AES key. Then, user A encrypts the AES key with the public RSA key of user B and sends both to user B. User B decrypts the AES key with the private RSA key and then decrypts the text with the decrypted AES key. Now, how should user A sign the message / AES key in order user B to verify that the message was actually sent from user A. If user A signs the encrypted AES key, would it be possible for user B to decrypt the signed AES key with the public RSA key of user A and then decrypt the AES key with his private RSA key?

Signing using RSA is done by first applying a cryptographic hash and then "encrypting" it with the private key of the sender (i.e. A). "Decrypting" the signature using the public key of the sender thus results only in the hash value, but not in the AES key. Since the hash function is one-way the original input (i.e. the AES key) can not be derived from the hash value.

Validating the signature by the recipient is instead done by first re-computing the hash value of the input (which is known after decryption) and then comparing this against the hash value returned by "decrypting" the signature with the public key of the sender. If they match the signature is valid.


New SSL certificate not being trusted on all clients I just got an old SSL cert renewed by GoDaddy.  It works fine on most clients I've seen.  However on some of our more restricted computers there is an issue.  These computers have GPO's set to block access to all websites that are not owned by us.  When they try to navigate to a site with this new SSL cert, they show a certificate error.  Instead of showing all 3 certs, they show ours, and the intermediate GoDaddy cert.

However, upon logging into a more privledged account that does not have the web restrictions, the site loads just fine.  Then switching back to the restricted account...  It begins to work to, and lists all 3 certs in the chain...

I'm a bit out of my depth here,  Does any one have any idea what is going on here?

Run Windows Update. I think you might have missed one of the regular Microsoft root certificate program updates.
Edit: Windows downloads CAs on demand, too
Windows has a mechanism that will check and add new CAs to the trust store upon contact.
Combined with the limitations on web access I imagine this might be responsible for the admin/nonadmin difference.


What is the encoding of that string? I try to find the encoding of a string. I thought at first it was Base64, but actually not, it seems ...

Let me explain quickly. For a exercise, I have to decode the following string: ZXJpcjRxbnJ1YnZxbmU=

I have to use a form on a website (I can't distribute the URL) that allows me to generate an encoded string from what I entered.

For example, if I type the letter A, I have this: Tg==
For B: Tw==
And fortunately, the value remains the same (so no grain of salt).

Can you help me? I'm on it for a while and I still have not solved my problem..

Thanks. o/

By looking at A= "Tg==" and B= "Tw==" and base 64 decode these values you'll get A= "N" and B= "O" which triggered me as it looks like some sort of substitution.

In your case they used double encoding because as it turned out, it is ROT13, which actually stands for ROTate 13 times:

Now in order to decode your message, you'll first have to base 64 decode the encoded string and then decode the result from ROT13.

ROT13 Decoder: http://rot13-encoder-decoder.waraxe.us/


Identicon for SSL certificate I have a few self-signed certificates that I use, and I find it tedious comparing the entire hex value of the hash when accepting it in a new location. To be honest I usually just look at the first couple or the last couple digits. If it were in some kind of visual form like gravatars are in, I feel like I would more easily identify whether or not they are correct.

I should probably be copying the certificates across as files and installing them rather than manually checking the hash and then accepting them but it is just so much easier to simply accept them sometimes.

Probably if it's something a human can identify right away visually, then there's not enough entropy to be very confident in its identity. I am just wanting a better way than looking at the first couple digits to bridge a bit of the gap between what's convenient and what's truly secure.

Is there any merit to the idea of certificate viewing software showing a gravatar/identicon for the hash of an SSL certificate, to aid in identifying it?

Is there any merit to the idea of certificate viewing software showing a gravatar/identicon for the hash of an SSL certificate, to aid in identifying it?

Yes. At least with OpenSSH this has been done. I don't see why it wouldn't work with SSL as well. But I know of no (live) implementation. There was a thesis from 2004 that showed an implementation of this for Mozilla, but I don't think it was more than a proof of concept. (See "Further reading" section.)

OpenSSH calls these images "RandomArt", "SSH Fingerprint ASCII Visualisation", "Visual fingerprint", "Visual Host Key". They have been there since version 5.1 from 2008. But I've only ever seen these images when creating a new key. Not when actually using one with ssh. (And that's because it's off by default on all ssh clients I've come across. You need the -o VisualHostKey=yes option.)

Further reading

SU:What is randomart produced by ssh-keygen?
Sec:How secure is Visual host key, and how is SHA2 converted into that representation?
Hongxian Evelyn Tay, Carnegie Mellon University, 2004-05-03, CS Senior Honors Thesis: Visual Validation of SSL Certificates in the Mozilla Browser using Hash Images


Is the IP (from) address of the email header 100% correct? Imagine I send one email with my e-mail client to a person B. Person B gets the email, and in the email header he/she can read the IP address from where it was sent.

Which IP address is written? The one of my router or of my email server? (In the case I do not host an email server.)

E.g. how I understood if the email was sent from a client email application then on the email header can be present the IP of my router, is this correct?

What I don't understand is why is this info so important if my home IP changes automatically once in 24h? Then the IP address present on the emails header cannot point back to me anymore.

Or do I miss something?

EDIT:

One more related question; when I send the email (with the e-mail client) to a person B, the email will go first to my email server. So when the email reaches the email server, in the header of the email will be already minimum 2 IPs "from addresses": the one of my router and the one of my ISP.

The question is:

1) Is the mail server keeping those "2 from addresses" and  together with his address send the email to the mail server B?

In this case, the mail server B gets the mail with "3 from addresses" with one pointing directly to my router

2) Or does the mail server "reset" the from addresses, so at the final point my router IP is not present on the mail server B (mail header)?

It depends, most email relays and mail servers will add headers with the sender's IP.  Yet nothing forces them to add the correct IP.  A typical email exchange would happen as:

email client -> your mail server -> destination mail server -> addressee's client

Yet, it can pretty well go:

email client -> local mail server -> remote mail server ->
  -> destination domain relay -> destination mail server -> addressee's client

Or an even more complex design.  SMTP (and its extensions) is pretty robust in terms to proxying/relaying.  And although this is not a requirement of SMTP most relays and mail servers simply keep all headers that are currently in the mail and just add their own on top.

This has a couple of interesting side effects, for example it isn't uncommon to find mail with several Received: headers.

Let's look at a couple of header examples in a rather complex mail path: The following is from a mail that uses google as a the mail server but has its own domain (i.e. the MX record for the mail domain is mail.google.com), the email then passes through a relay and then back to mail.google.com to a different gmail address.

First of all we get:

X-Received: by 10.x.x.x with SMTP id d27mr24214681oib.59.1473677977339;
        Mon, 12 Sep 2016 03:59:37 -0700 (PDT)
Received: from 1058052472880 named unknown by gmailapi.google.com with
        HTTPREST; Mon, 12 Sep 2016 06:59:36 -0400

This is from the client to gmail, note that the IP that google saw is there.  Next it goes to the relay:

Received: from mail-it0-f41.google.com ([209.x.x.x]:37883)
        by mail.fsf.org with esmtps (TLS-1.0:RSA_AES_128_CBC_SHA1:16)
        (Exim 4.69)
        (envelope-from <******@hotelquickly.com>)
        id 1bjix0-0003Rs-3K
        for ******@member.fsf.org; Tue, 13 Sep 2016 04:20:18 -0400
Received: by mail-it0-f41.google.com with SMTP id 183so31757158itf.0
        for <****@member.fsf.org>; Tue, 13 Sep 2016 01:20:17 -0700 (PDT)

So we have one of google's mail server's IP talking to the relay at mail.fsf.org

And finally back to google:

Received: from mail.fsf.org (mail.fsf.org. [208.x.x.x])
        by mx.google.com with ESMTPS id n48sd14225674qtn.126.2016.09.13.01.20.23
        for <******@gmail.com>
        (version=TLS1 cipher=AES128-SHA bits=128/128);
        Tue, 13 Sep 2016 01:20:23 -0700 (PDT)
Received-SPF: softfail (google.com: domain of transitioning ******@hotelquickly.com does not designate 208.x.x.x
        as permitted sender) client-ip=208.x.x.x;
Authentication-Results: mx.google.com;
        dkim=pass header.i=@hotelquickly.com;
        spf=softfail (google.com: domain of transitioning ******@hotelquickly.com does not designate
        208.x.x.x as permitted sender) smtp.mailfrom=******@hotelquickly.com;
        dmarc=pass (p=NONE dis=NONE) header.from=hotelquickly.com
Received: from Debian-exim by mail.fsf.org with spam-scanned (Exim 4.69)
        (envelope-from <******@hotelquickly.com>)
        id 1bjix0-0003Rx-7z
        for ******@member.fsf.org; Tue, 13 Sep 2016 04:20:22 -0400

And there is even more because I use procmail but by then it deals with local IPs only.

In summary

Most machines will add the IPs of the machines they received mail from to mail headers, yet there is nothing forcing the machine to add the correct IPs.  If you run your own mail server you can add misguiding IP addresses, yet the next hop in the mail path will add the IP it believes your mail server has to the headers (i.e. the mail server it received the mail from).


Can I safely trust my Anti-virus protection? Recently when I was trying to install a software which didn't happen to be from reputed sources, my anti-virus popped up a warning saying:

XYZ-antivirus blocked you from visiting an infected webpage

My question here- am I being too paranoid thinking that I could have been infected even though my anti-virus says it blocked me from visiting the infected webpage?
Or in more generic terms- can an end-user, who may not be a techie, just be happy by trusting his anti-virus solution assuming he uses a decent one and keeps it updated?
Does he need to be bothered about "am I infected?", "should I nuke it from orbit?" when he sees such occasional messages about a virus or a trojan detected in his USB stick or the one that I got above?
p.s.:  I could very well share the name of the anti-virus I use, but I thought of keeping it a more generic question.

There are two distinct cases you should consider:

Your AV software blocks malware.
Your AV software removes or cleans malware.

The first one means that it was able to remove the threat before it executed, e.g. it detected malicious code in a file you were in the process of downloading. As such, your system should be safe. No malicious code actually executed on your machine.

The second one means that the malware executed on your machine, but was later removed. At this point, malicious code has executed on your machine, so there's a chance it could still be infected (e.g. with a kernel-mode rootkit that your AV software can't detect). At that point it's probably time to nuke it from orbit.