How "scrambled" is the data on a RAID5 disk? My concern is the disposal of a replaced disk from a private RAID5 disk array.

I have had to replace a disk from my personal RAID5 disk-array. It had started developing errors, so out it went.

But now, I have this disk lying on my desk and that got me wondering... The data on the array was never encrypted. I'm concerned that turning it in at the recycle-station could be a security-risk.
Is it possible that some mischievous individual would be able to retrieve personal data (photo's, files etc.) from the disk? Or is the fact that it was part of a RAID5 array sufficient for the data to have been scrambled beyond recognition?

Raid 5 stripes the data across the disks but the blocks used for striping are typically pretty big. At the very least they will bewhole sectors but normally they will much larger than that. For example madm defaults to half-megabyte chunks. Even one sector is big enough that you are likely to find recongisable chunks of text and with typical chunk sizes it is quite likely entire recognisable files will be present on the individual drives from the array.


This Program Can not Be Run in DOS Mode I'm doing a pentest on a Windows XP box and have achieved a shell with low privileges. As such, I am trying to escalate my privileges. However, every .exe I try to run is giving me "This program can not be run in DOS mode". Is there any sort of configuration I need to change on the box or is there a different strategy for privilege escalation in an environment such as this?"

Background
That message is from the basic header that every Windows (PE format) executable has. The message (and the code that displays it) is technically editable, but all compilers seem to just emit code that displays that same string and then exits. It's 16-bit executable code (like a DOS .COM file), intended to be displayed when you try to run the program on MS-DOS or similar pre-Windows systems. Windows' program loader typically skips over it.
Explanation
However, there is one case where Windows might display that message: when you try to run a PE that is compiled for a more advanced version of Windows than the one you're using, especially if the main program code is for a different CPU architecture than the OS can support. (This is similar to, for example, trying to run Win32 code on 16-bit DOS.) From a GUI, you'd get a pop-up error, but in the command line, you may well just get that message.
The obvious candidate here is that you're trying to run code on the (hideously obsolete) Windows XP, and you say you're using "i686-w64-mingw32-gcc". If you're compiling 64-bit binaries for Windows XP, it's extremely likely they won't work; while a 64-bit build of XP technically exists (it's actually a different kernel version, 5.2 vs. 5.1, but it's branded as XP), it was never widely used; the extremely vast majority of XP boxes are 32-bit only. If you want a quick check for 32-bit vs. 64-bit from the command line, check for the presence of a \Windows\SysWOW64 directory (which holds 32-bit system binaries on 64-bit machines); if it doesn't exist, you're running on a 32-bit OS.
Recommendation

Unless you A) need 64-bit for something, and B) know your target is 64-bit, only use 32-bit payloads.
Make sure your code and compiler are targeting XP (Vista and later added a ton of new APIs that will prevent a program which uses them from running on XP).
Consider spinning up an XP VM to test whether your payloads run locally before trying them on the target machine.


Possible to identify a hash type by length? I have a file that contains a bunch of different types of hashes in it:

a94a8fe5ccb19ba61c4c0873d391e987982fbbd3
90a3ed9e32b2aaf4c61c410eb925426119e1a9dc53d4286ade99a809
f8d3b312442a67706057aeb45b983221afb4f035
768412320f7b0aa5812fce428dc4706b3cae50e02a64caa16a782249bfe8efc4b7ef1ccb126255d196047dfedf17a0a9
a94a8fe5ccb19ba61c4c0873d391e987982fbbd3
9f86d081884c7d659a2feaa0c55ad015a3bf4f1b2b0b822cd15d6c15b0f00a08
ee26b0dd4af7e749aa1a8ee3c10ae9923f618980772e473f8819a5d4940e0db27ac185f8a0e1d5f84f88bc887fd67b143732c304cc5fa9ad8e6f57f50028a8ff
db346d691d7acc4dc2625db19f9e3f52
098f6bcd4621d373cade4e832627b4f6
a94a8fe5ccb19ba61c4c0873d391e987982fbbd3
a94a8fe5ccb19ba61c4c0873d391e987982fbbd3
a94a8fe5ccb19ba61c4c0873d391e987982fbbd3
90a3ed9e32b2aaf4c61c410eb925426119e1a9dc53d4286ade99a809
a94a8fe5ccb19ba61c4c0873d391e987982fbbd3
a94a8fe5ccb19ba61c4c0873d391e987982fbbd3
5e52fee47e6b070565f74372468cdc699de89107
f8d3b312442a67706057aeb45b983221afb4f035
098f6bcd4621d373cade4e832627b4f6
db346d691d7acc4dc2625db19f9e3f52
768412320f7b0aa5812fce428dc4706b3cae50e02a64caa16a782249bfe8efc4b7ef1ccb126255d196047dfedf17a0a9
9f86d081884c7d659a2feaa0c55ad015a3bf4f1b2b0b822cd15d6c15b0f00a08
ee26b0dd4af7e749aa1a8ee3c10ae9923f618980772e473f8819a5d4940e0db27ac185f8a0e1d5f84f88bc887fd67b143732c304cc5fa9ad8e6f57f50028a8ff
5e52fee47e6b070565f74372468cdc699de89107
b913d5bbb8e461c2c5961cbe0edcdadfd29f068225ceb37da6defcf89849368f8c6c2eb6a4c4ac75775d032a0ecfdfe8550573062b653fe92fc7b8fb3b7be8d6

These hashes have no salt and I can find out what kind they are. What I would like to do is identify the different types of hashes using a program, is it possible to identify a hash by length or by specific characters?

What I know is that every hash (as far as I know) has the letter a-f and the numbers 0-9 in them, so I was thinking I could identify the hashes by length, would it be possible to identify a saltless hash by the length of the hash?

For example the hash of the word test using SHA1 is a94a8fe5ccb19ba61c4c0873d391e987982fbbd3 which is exactly 40 characters long, the word test using MD5 is d41d8cd98f00b204e9800998ecf8427e which is exactly 32 characters long. If I could figure out the length of each hash (md5, sha1, sha256, etc) would it be theoretically possibly to make an estimated guess on what kind of hash would be shown?

Hashes are commonly represented that way so they are readable/printable characters. They are representations of the binary values generated by the hashing process, thats why they use the same standard base16 character set.

Many hashes, yes, are predictable by length.

MD5 is 128 bit
SHA1 is 160
SHA256 is 256, 512 etc etc.
Divide those by 8 to get the length in bytes, then times that by two for the length when represented as ASCII.

However it is not foolproof. as SHA1 and RIPEMD-160 are both 160 bits. Odds are it will be SHA1 so you can make an educated guess, but no guarantees

Equally someone might be (rather stupidly) truncating the hash or all sorts of craziness or not using common hash types. It would be an educated guess only.


Risk in adding shared mail server to my SPF like sendinblue/sendgrid for mail reputation? My enterprise would like to make some mass mailing to their customers, using a third party solution (e.g.: sendinblue, sendgrid, mailchimp...).

Is there a real risk that my domain mail address could be considered as spam if the shared IP is badly used by one of the shared service's evil customers (e.g., for spamming, even just for a week)?

In the worst case, would every mail sent under this enterprise domain name be considered by the security solutions as some spam (iron point, proofpoint...) and blocked?

In such scenario, how long it could take to be back a good mail reputation?

The IP that the email service uses would be blacklisted, not the domain. This affects the service more than your company, which is why they tend to have very strict controls and procedures.

It does mean, though, that if you depend on that service, then you will be impacted by your emails not getting out if sent through that service.


How to test ModSecurity rules against access/error logs? I'm looking to build up some stats and tune my detection rules for my webservers. I'm struggling with one major issue, though. How can I run my ModSecurity rules against past requests based on my access/error logs?

An other approach could be to extract regexes from ModSecurity but I struggle to find a way to do that.

I don't think this will be possible, and even if you find a way to do it, it won't represent the real world correctly.  Many mod_security rules rely on a variety of data, including various headers in HTTP requests, as well as HTTP request body data.  Much of this data (most notably the body of requests) is not generally logged (at least in default configurations), so even if you could feed the logs back in, mod_security would not be able to evaluate the full request.


Virus changed Google Chrome installation folder I got the malware zooarm on my system, and it has changed my Google Chrome folder path to this:

Executable Path: C:\Program Files (x86)\Zooarm\Application\chrome.exe
Profile Path: C:\Users\Shaharyar\AppData\Local\Zooarm\User Data\Default

What problems or security issues can it cause me?
I am using Windows 10. It also stopped my Windows Defender, and I don't know how it got so many privileges to do such things.

If there's been a malware intrusion, chances are that they have elevated their privilege to administrator. If so, then you should probably think about reinstalling Windows rather than removing the malware, as its hard and toilsome to measure the impact of the malware on your OS.


Slow HTTP POST vulnerability in IIS 10 I ran a Qualys scan on my website and got a Slow HTTP POST vulnerability. In particular, server resets timeout after accepting request data from peer.
From what I understood from this finding, whenever a similar client restarts its connection to the server, the timer is reset. I have so far configured the connectionTimeout, headerWaitTimeout and minBytesPerSecond in Application Host config maxAllowedContentLength  and maxURL in web.config. How or what else do I need to configure in IIS to resolve this?

The core issue is that http.sys processes all requests for RFC compliance before passing them to IIS. Thus any IIS Request Filtering setting is meaningless. Even maxContentLength=1 will do nothing if one were to upload a large amount of data. Http.sys will continue to accept the stream. This was identified on a similar thread here (Spoiler alert! http.sys does!):

Does IIS Request Content Filtering Load the full request before filter

Default Limits for Web Sites
Tune your website limits in particular connectionTimeout. This will drop long-lived connections and large data uploads. Note that these settings are for the entire site so other pages or services allowing file uploads should be considered when establishing these values. Take the maximum amount of data one should upload along with the lowest allowed speed. However long it takes to transfer that amount of data at that speed is your connectionTimeout value.
Request Filtering
While Request Filtering won't directly address your question, it greatly improves security and may also improve website performance. This is because the module runs very early in the pipeline discarding bad requests before they can get to the slower application layer logic. I wrote a PowerShell module IISRFBaseline which aims to take much of the guess work out of establishing these values by analyzing the IIS logs and website content directory. There's also plenty of README.md to answer any setting specific questions.
Qualys Recommended Remediation
Qualys offers great tips for addressing this finding though I believe there's too much emphasis on Request Filtering for the reasons mentioned above. That said, here's their recommendation:

Limit request attributes is through the <RequestLimits> element, specifically the maxAllowedContentLength, maxQueryString, and maxUrl attributes.
Set <headerLimits> to configure the type and size of header your web server will accept.
Tune the connectionTimeout, headerWaitTimeout, and minBytesPerSecond attributes of the <limits> and <WebLimits> elements to minimize the impact of slow HTTP attacks.

Source: How to Protect Against Slow HTTP Attacks


S/MIME certificates and "information leakage" I'm considering getting an S/MIME certificate that verifies my name and email address. I've been trying to ascertain what information "leaks" if I do.

The Wikipedia page on S/MIME says:

  Depending on the policy of the CA, the certificate and all its contents may be posted publicly for reference and verification. This makes the name and email address available for all to see and possibly search for. Other CAs only post serial numbers and revocation status, which does not include any of the personal information.

What exactly is this referring to? CRL's? Or does that seriously mean that some CA's have some sort of public interface for searching for issued certificates and the information contained in them?

And how do I even find out what a given CA's policy is? I learned about Certification Practice Statements and Certificate Policies and read my chosen CA's ones, but they do not contain this information (or I failed to find it).

My name and email address are hardly secret information, but I do not want them becoming publicly searchable. Of course the public certificate itself would contain them.

To be specific, I'm looking at GlobalSign and their PersonalSign 2 certificates. Yes, I did contact their support but they did not respond (at least yet).

FWIW, I reviewed their CRL and OCSP information and a user agreement. Here's what I was able to determine.

The UA states they have the right to revoke your certificate for any number of reasons out of your control and also if you ask for revocation. Normally, they'd never revoke a cert without the owner asking, so most likely this is a low probability event. If you revoke it, it's because it was compromised and then it will be on a revocation list somewhere.

Why is revocation important?

Because this is the only case I could think of in which your cert has some public profile.

CRL - Certificate revocation list - contains a list of cert IDs, not the original certificate.

OCSP - online certificate status protocol - allows realtime queries for current cert status. However, you need the cert ID to do the query.

In neither of these cases can someone get all information embedded in the cert. So, no exposure of email address through these.

Also, it looks like they have an enterprise product for which a company can run its own sub-CA, for employees. I didn't study this product, however, it's possible that it contains a "public" database of certificates feature. Since that's the equivalent of an internal phone book for employees, it wouldn't surprise me.

Although you might want to continue questioning their policies regarding publishing of certificates in general, I couldn't find anything that looked like what you mention in your question. Publishing issued certificates is an unusual practice for any Certificate Authority.

I'd say this is one of those cases in which Wikipedia may have misleading information.


In IKE protocol; what is the PRF? In IKE protocol; what is the PRF ?
What is "the generation of a key based on modeled random oracle hash functions"?

In IKE, the "PRF" is subject to negotiation between the two involved entities. There are several defined PRF in use; most are HMAC, with MD5, SHA-1 or with one of the SHA-2 functions. At least two AES-based PRF have also been defined: AES-XCBC-PRF-128 and AES-CMAC-PRF-128. The role of the PRF is to serve as internal engine for key derivation and similar usages within the protocol.

The expression:

  the generation of a key based on modeled random oracle hash functions

means that a key will be generated by applying a sort-of hash function on some input, and the security of the process will be ensured if the hash function behaves like the abstract mathematical concept of a random oracle. The intuitive idea of a random oracle for key generation is that if you derive several keys from the same input set, with just minor variations (e.g. for a given input X and hash function h(), you compute h(X||1) and h(X||2) to get two derived keys), then nobody would be able to learn anything about any of the keys even if he knows all the others. The "random oracle" is the academic term which somehow means "perfect hash function".

(The mathematical details of the notion of random oracle are intricate, and I won't delve into more details here. The sentence you quote is mostly a private signal for cryptographers: it states that whoever wrote the text knows or pretends to know cryptography, and indicates to other cryptographers under what mathematical assumptions the security analysis has been performed.)


Validate hmac with hashed stored key What if an HMAC is correctly generated and sent with the data to the server, so far I know the server needs to know the original data with which the MAC was created in order to re-create the MAC and compare, but in this scenario the server has everything except that the key is hashed and not stored "plain". How can the server validate the MAC?

If you don't know the key, you can't generate the HMAC. That's the whole point of a HMAC - it's a quick way to provide message integrity using existing key material. If you could regenerate the HMAC without the key, an attacker could simply generate a HMAC for a different message and alter the payload.


What do I do when a ISP stores passwords as plaintext I am living in a student housing in UK.

Today, I was suddenly asked to put in my log in credentials for the internet service and because I forgot the credentials, I went to find my password section.

Guess what... an ISP... storing password as

PLAINTEXT!

The blacked out section after

"You password is:"

is not a temporary password... it actually is the full, existing password that I entered at sign up..

Is there any way to report this and force them to encrypt their passwords?

Definitely make sure you are using different unique and complex password for each site - especially something like your ISP.

And of course http://plaintextoffenders.com/


How to detect infected devices on your local network Today I read about a researcher who bought a digital TV recorder and connected it to the internet - probably using port forwarding to enable attackers to connect to the recorder. After a while someone was able to connect with Telnet, and upload software to mine bitcoins.

If this is possible, other malware could be installed that tries to infect other computers in the network. Because these devices are not monitored they are ideal for hiding out.

So your average Windows computer is infected with malware, it finds a tv recorder in your network, infects that. The Windows PC is cleaned of its malware, but the recorder stays undetected, and after a while it infects another computer, etc...

How can I detect infected devices on my local network? What methods are there to prevent this from happening?

Most of the malware in our network is detected by the odd traffic it generates.
For example, when a device on the network is communicating with a known bot command and control network, we know it immediately.  Infected devices will also try to communicate in unexpected ways with other devices on the network and this is also detected.  We implement (and adjust) rules about what traffic generates alerts.  One such rule is attempted communication with addresses that were registered within last 14 days.

Of course, it is an arms race as malware comes up with interesting ways to evade such detection.

Second most common way is the anti-virus scans we do.  Brand new malware won't have a signature, but eventually the signatures are known.

I know you are talking about a home network, but the same technique applies.  You would have something like Snort installed and write signatures about what traffic is allowed between your Windows machine and that DVR described in the article.  Malware communication will hopefully trigger the alert in Snort so you can detect the infection.


How do I select a switch that protects against CAM attack? Are there any flags/attributes, that I can see when buying an ethernet switch? I mean does it has a little message on the box of the switch, or any tech specs, from where i can see that the given switch is going to survive a CAM attack?

CAM table attack in 2011?

For consumer-grade, off the shelf switches, you are unlikely to find port-security and/or MAC limiting features in unmanaged or 'dumb' switches.

If you move into the managed or 'smart' switch space, you will start to find these features. However they do come at a price, and often require some knowledge of the platform to configure. Typically these switches are used in businesses.

Companies like Cisco, HP and Juniper are companies who produce products which typically include these features. Each product tends to call the feature something different, so you would need to read through the spec sheet and do your research, if unfamiliar with the product or platform.


Is Eraser secure and efficient? I have come across a file eraser called Eraser, and I have two questions about it:

Are file erasers sufficient for completely removing secure files/folders on a computer (meaning is it possible, in any way, for the data to be recovered).
(Slightly less important.) How can I verify the security of Eraser? Are there websites or companies that have checked the software for back-doors/security flaws that would compromise the security of my data?

I've tried that tool, and it's fairly good and secure. I have also tried to recover data (using professional software) after using eraser and nothing. It's not good as Blancoo or BCWipe, but it is sufficient.
Non-free tools have also verification of wiping process. Also I'm not sure if eraser will consider removing HPA and DCO.


IoT Devices and 39 Month TLS Certificate Life I develop IoT (Internet of Things) devices on small embedded systems, where it is very difficult to update the local certificate once they have been deployed. It really needs to be avoid if it can.

With the new 39 month age for TLS certificates, I am trying to understand how this will effect my development options.

I will usually install a Root CA from Baltimore or others on the device during the manufacturing process. But will this now mean that I will need to update the certificate on my device every 39 months?

Or have I misunderstood what is going on. Will it only be the servers's certificate I need to replace and not the root CA on the device?

Basically I need to understand what can I do to ensure I do not need to replace the certificate for the entire life of the device. Hence it will need to be in the 10 years + time frame.

Solution Architecture

Embedded Device <----Internet----> Cloud Service (Server)

The Embedded Device is the client which has a ROOT CA installed to enable direct communication over TLS 1.2 with the Cloud Service (Server)

The type of devices we are talking about are small embedded devices like those used in smart meters or sensor nodes for factories or agriculture. They could be deployed into the millions potentially.

Large edits because now it is clear that OP is asking about devices which only work as a TLS client...

If this is only for client devices than you don't need to update the certificate on the device since there is no certificate on the device. The certificate is on the server (which you need to update) and is checked against the root-CA on the client device. With this root-CA it will accept all certificates issued by this CA, even future certificates. Which means you depend on the same CA issuing certificates within the life time of the device. You might still need a secure way to update the firmware in case yet another buggy TLS stack happened or regulations require the use of better cryptography within the 10+ years time frame.

Yes, you need to have some secure way to update the certificate for this device. One reason is the 39 month limit, another is a possible compromise of the public key used for the certificate (how it is protected anyway for such a long time?).

And given all the recent bugs in TLS libraries you better have a secure firmware update too. Apart from that you either need your cryptography ready until the end of the 10+ years time frame or you need to have ways to upgrade the algorithms and protocols in use. Note that within this long time frame  TLS 1.0 and TLS 1.1 will probably get deprecated, as do 2048 bit RSA keys. It might also be that the not yet released TLS 1.3 will be already required.

  Will it only be the servers's certificate I need to replace and not the root CA on the device?

The Root-CA on the device is only needed if you make TLS connections from the device. If you need to do this then you probably will need to update these root-CAs too because several root-CA will expire within this time frame so you cannot verify connections any longer.


What benefit does the IE setting "Block unsecured images with other mixed content" provide? Internet Explorer has the security setting shown in below screen shot.

My understanding is that "unsecured images" are images that are not transmitted over HTTPS.

What I am curious about is why does this setting specify the blocking of images, as opposed to other possible non-HTTPS content?

Is there some benefit that can be gained by blocking images in particular? Or what is the reasoning behind this setting?

The reasoning behind this is that in most cases, the unsecured content is only ad banners, and will not be of any concern. Thus IE allows insecure images on a otherwise secure page by default.

Note that its NOT possible to run an image as JavaScript or executeable code, so a unsecured image cannot affect the page contents on a otherwise secure page.

Other content however, can modify the content on the page, for example a JavaScript loaded over a unsecured Connection could modify the HTTPS page to for example change the action of a form, and if a hacker then modifies the .js file in transit, then they could possible "subvert" the HTTPS page.

However, there is 2 cases where images still might be a concern:

If the image is modified to be "protected by basic auth", then the browser might popup a authentication dialog, that can trick you into thinking the authentication dialog belongs to the HTTPS site. However, IE will warn, see this Picture, if BASIC+HTTP is mixed:

If the attacker uses digest, he will not be able to gain any password information. So never enter any username or password if the dialog carries the warning above, if you're on a HTTPS site. Only DIGEST+HTTP, BASIC+HTTPS or DIGEST+HTTPS will suppress the warning shown above.

Another case where you would want to block insecure images, is if the images itself contain sensitive information, or if sensitive information is transmitted with the images, for example: http://example.org/loadimage.php?creditcardnumber=1234-1234-1234-1234

But both these cases is very uncommon, so you can safely keep the setting off (allow load of insecure images on HTTPS pages)


ZAP: Can't Execute Scripts within Zed Attack Proxy I try to execute the community script "Extender/HTTP Message Logger.js". I first double click on the script to make it open in the scripting console. However, in the scripting console, the "Execute" button is disabled and I see no other way how to make it run.

What am I missing?

You don't execute Extender scripts, they're either installed (Enabled) or not (Disabled). Read through the code of the Message Logger, it's meant to write traffic to disk (in its default form, only JSON traffic).


How can I detect OS by sniffing network traffic? Is it possible to sniff a network (WLAN) and find out what operating system are installed on network clients (PCs/Phones etc)?

I am using Ubuntu.

nmap has the ability to guess the operating system by looking at variations in how a device reacts to TCP/IP probes (see the nmap website for details).

You can also make a guess at the identity of a device by looking at who its MAC address was allocated to.  For example, something with an address in a Hewlett-Packard block is probably a network printer.


Understanding a proof of concept I found this report about a buffer overflow vulnerability  in websocify. I do not understand how this line

$ curl http://example.com/$(python -c 'print "A"*5000')

triggers the vulnerability. I think the address will be expanded to http://example.com/AAAAAA.... I do not know how websockify relates to this.

Using the code from the bulletin:

ws_ctx_t *do_handshake(int sock) {
    char handshake[4096], response[4096], sha1[29], trailer[17];
    [...]
    offset = 0;
    for (i = 0; i < 10; i++) {
        len = ws_recv(ws_ctx, handshake+offset, 4096);
        if (len == 0) {
            handler_emsg("Client closed during handshake\n");
            return NULL;
        }
        offset += len;
        handshake[offset] = 0;
        if (strstr(handshake, "\r\n\r\n")) {
            break;
        }
        usleep(10);
    }
    [...]
}

offset = 0
ws_recv (ws_ctx, handshake + 0, 4096) => 4096
offset = 4096
handshake[4096] = 0; // out of bounds write.
no double-CRLF found, loop
ws_recv (ws_ctx, handshake + 4096, 4096) => entirely out of bounds write.

The loop seems to have been designed with the assumption that it would only loop due to receiving insufficent data.  By throwing gobs of data at it it looped anyways but after the first pass it no longer had properly constrained memory.

The 3rd parameter should have been 4096 - offset, representing the amount of space remaining, not the total buffer space (since ws_recv didn't get the total buffer unless offset==0).  (Or they needed to reallocate, et cetera).


Confusion about the way password managers work I've been reading about password managers recently out of personal interest, however since I don't have any experience in the area of information security, I found myself confused about two aspects after watching the following Computerphile video.

Let's say I download and set up one of the commercially available password managers on my device A. I understand that what the server (i.e. the 'vault') stores is only encrypted information that is useless if intercepted. To decypher this information, one needs some kind of a 'vault key' generated from my master password by hashing it. I can verify my identity with the server by using the authentification key, then download my vault and decypher it to recover the actual passwords on device A.

Now, if I try to do the same on device B, in order to authenticate myself again, presumably I need to replicate the same hashing procedure to tell the server it's me again who's trying to access the data. If that's true, then the information about how to hash my master password correctly has to be somehow transferred from A to B? Does that not leave the possibility that someone can intercept that information when it's being synchronised across devices and therefore pose a security threat? Or does it simply not matter as long as the attacker doesn't know my master password, since then they won't be able to reproduce my vault key or authentification key anyway, even knowing the right hashing procedure?
Can the authentification key be intercepted when it's trying to access the encrypted data on the server? Then, the attacker would be able to access and download all this data. Again, is that not a concern because, as the video mentions, there is no way to replicate the vault key from the authentification key, so the data cannot be decrypted? Why is that impossible?

Please point out any mistakes in my reasoning. I would be grateful if you could recommend some resources about how password managers deal with security issues like that in greater detail - the information readily available on their websites is quite basic and I don't really know where to look for something in-depth.

No communication is needed about "how to hash my master password correctly". That information is the same for every device and is defined by the password manager software which you run on your computer.

As for intercepting the hash, the most secure password managers would either use a "zero knowledge" system like Secure Remote Password (SRP) to prevent your password from ever leaving your computer in usable form (for example, 1Password uses this); or alternatively they might use a separate "account password" to log into the provider's server and retrieve the vault, with a different "master password" used to actually decrypt the vault.

Less secure password managers might actually send your master password, or some hash of it, to the server directly. This could in theory be intercepted as you fear, however any password manager with even a modicum of security will at least do the login over HTTPS or a similar encryption channel, which will prevent any such interception unless you or their servers are already compromised in some way, or unless they have made a mistake in the implementation which adds a vulnerability that can be exploited.


HIPAA data encryption - Is database level encryption is enough? If the database has a built in encryption possible such as Azure SQL Server's, Transparent Data Encryption (TDE) would this be enough for getting the HIPAA compliance ? Or even before storing any data that could be PHI like dates, names has to be encrypted and then written to database ?

For HIPAA, there are two types of encryption you want to consider:

Transport Encryption - This is where communications that contain sensitive data is encrypted so the raw data cannot be intercepted. A popular example of this is SSL and HTTPS.
At-Rest Encryption - This is where your sensitive information is encrypted on a storage device. Your example with encrypted databases counts as this.

Your Transparent Data Encryption should suffice for at-rest data, but it does nothing to encrypt your communications - make sure you have something in place for that too. Merely sending the data encrypted over unencrypted communications (such as HTTP or FTP) isn't enough, as the structure of these communications can still be read, the encrypted data can still be pulled out, and if the attacker extracts a competed set of data, they can begin cracking it with their own local resources. Encrypted transport sending encrypted data will make this task much harder.


OAuth provider that authenticates only by phone? I'm trying to find an OAuth provider that doesn't require a password but instead, it authenticates the user by sending a message to a phone number. I'm thinking that it would be using the phone the same way as you would use two-factor-authentication but without the password.

So far I couldn't find any. Does such provider exist?

If it does exist then what risks associated with such a use-case do you see?

Thanks!

There is not, it's not based on FIDO

Look up sim swapping.


Access-Control-Allow-Origin wihout AJAX This answer  (incorrectly?) states

  No, as long as the CORS Access-Control-Allow-Origin is at its default restrictive value. This prevents the outer website from accessing the framed website via Javascript/etc.

However, I was pretty sure that a framed website cannot be accessed unless it is the same domain, regardless of CORS settings:

e.g. this answer

  an iFrame cannot read the contents of another iFrame unless they are
  on the same domain.

and this answer

  Frames have scripting rights and protections granted by the Same-Origin Policy. A script executing on a parent cannot read the contents of a child iframe that is of another domain.

So my question is, if CORS is implemented, is it possible for one domain to read content from another domain without issuing an AJAX request?

e.g. in the first post

  Victor can verify the contents of the HTML it retrieves and verify all referenced scripts as well.

How would this be achieved? Can it be achieved without AJAX (i.e. is it possible to read cross frame or via any mechanism in the DOM, or is it a case of one site issuing an AJAX request to the other?).

Cross-origin resource sharing is dangerous,  and more effort has been put into locking down the SOP than technologies such as CORS which bend the rules.  At the end of the day I don't want people reading my email because I'm visiting their website.  (They need to earn that right with an 0-day!)

CORS is strictly a JavaScript feature.  Although,  I hadn't thought of it until this post,  but why shouldn't CORS be used to break other SOP rules?   This can be implemented in a secure way, and more importantly it would be regular.

Can a domain access another domain without Ajax and CORS?  The answer is yes,  after all we had a solution to this problem before CORS.   Before CORS, there where two major ways that web apps broke the SOP.  The first method is to use a Cross-Domain Proxy which is a server-side component to fetch inaccessible content on behalf of the client.  The second method is XSS,  yes people actually intentionally implemented an XSS vulnerability for the purposes of resource sharing,  which is indiscriminate.  As a result CORS is strongly preferred over these methods.


Is Mailbait still a threat? Is Mailbait (or similar services) still a threat, was it ever a threat, and if so how can it be mitigated?

Mailbait is that service that promises to fill up your email inbox by sending you a huge amount of spam. Apparently it automatically subscribes you to several mailing lists. It's meant for "testing purposes", however an attacker can use it to DoS somebody else's email address. I haven't tested it. Online you can find people that say somebody used their email address on Mailbait, and they started to get so many emails that they even exceeded the maximum allowed incoming rate, even if the spam filter was blocking the majority of them. On Gmail by the way, not on some crappy email provider. However you can also find people that say they tried that "service", and it didn't work (maybe because they had a different spam filter that was blocking all of them, or maybe because spam filters had been updated in the meantime?). Most comments tend to be pretty old though (some years ago), so I'm wondering if it was ever a serious threat and if it's still an issue.

Whether or not those services are a threat is subjective and depends on your threat model. Whether or not they exist and can DoS a victim's mailbox with varying levels of effectiveness is not. Those services do exist and they can completely flood and deny service to someone's mailbox. In fact, you do not even need to use those services. For a long time, there have been quite a few ways to screw someone over, including manually signing them up to a large number of spam lists, or publishing their email in plaintext in comments on heavily-spammed or spun blogs and fake articles. It's the digital equivalent of signing someone up to receive a hundred free Bibles or delivering a dozen pizzas to their house. While I can't say if Mailbait works, the concept of DoSing someone's mailbox by getting them on spam lists does.


PCI Policy Management software? I am working on a project to get our company PCI Compliant. One of the key issues I face is managing PCI/Security policies in the organisation.

I am responsible for creating the policies and distributing it. I find on many occasions when I hand over a policy that the user does not sign the document or maintain it. There seems to be a lot of admin overhead just trying to get people to sign the documents.

Does anyone know of software that can be used to automate the processes and maintenance surrounding policies?

Key features I believe is important are:

Automated way of getting users to acknowledge new policies/updated
policies
Assigning owners
Templates for formulation of new policies

Any suggestion would be great. We are on a tight budget so I need a cost effective solution.

I would recommend using a wiki to store the policies, you then get versioning, etc. You can also create templates which include the document control information you need to evidence such as the change date, approval date, effective date, etc. You could probably get away with a lightweight wiki, but if you have SharePoint or KnowledgeTree those might be the way to go. Semantic Media Wiki might also be a good choice. The wiki route is also good because you can embed keywors and tags, such as the applicable PCI requirements which makes it much easier to track individual policies and cross reference.

If we look at the PCI Scoring Guidance, we see that 12.6.2 says

  12.6.2 Verify that the security awareness
  program requires personnel to
  acknowledge, in writing or electronically, at
  least annually that they have read and
  understand the information security policy

Always consult with your own QSA, but if you have a small enough group, you can probably combine this somehow with your annual training in 12.6.1; do a training session with a sign-in sheet and another column for policy sign-off.

If you use outlook, you can use the voting button functionality to collect responses, but you would probably be best served implementing some type of survey web-app that allows you to build survey questions. You could be extra rigorous and test them on what they read, but your basics would be a name field, a checkbox, and maybe an additional field for initials for a digital sign-off. If you use SharePoint, again this can be used to collect surveys.

I don't have any familiarity, but I did a quick search and came up with these:

policyIQ (commerical policy management software)
Power DMS - Policy Workflow (another commercial solution)


What prevents this specific type of attack from being viable? Imagine a user has an ip of 1.2.3.4
The server the user intends to connect to has an ip of 2.3.4.5
An attacker has a machine with a promiscuous network card on the user's local network.
The attacker also has a server on a seperate network with ip 3.4.5.6
The user sends a request to 2.3.4.5, which the attacker had DDOS'd. As such, 2.3.4.5 will not respond.
The attacker's machine on the user's local network sniffs the request and sends it to the 3.4.5.6; 3.4.5.6 is set up to take this information to form a request to 1.2.3.4 where it spoofs the IP of 2.3.4.5 and has all the required TCP Sequencing information to form a request that looks real.
When the user sends another request, it is once again sniffed by the attacker's local machine and sent to 3.4.5.6 which can then send another false request. The cycle continues.
Since 3.4.5.6 appears to be 2.3.4.5 and since 3.4.5.6 is NOT located on the user's local network, the user's firewall is unable to detect any foul play.
I'm assuming that this type of attack is not actually possible and that somewhere there is a misconception on my part about how networking works. Why would an attack like this not be possible?

An attack like the one you describe is very possible.  In fact, it's even simpler to pull off an attack like this if you control the network's gateway router (e.g. if you provide wifi service in a public space).  In that case, you can redirect any outgoing request to a server that you control.
This is why it is important to always connect using a secure protocol.  And, this is why we have PKI, certificates and certificate authorities.
Users don't typically make requests using IP addresses like 23.201.25.188, they make requests using FQDNs, like www.paypal.com.  If a user points his web browser to https://www.paypal.com/, and an attacker redirects this request to a server that he controls, the browser would display a warning that the connection is insecure, because the malicious server would not have a valid CA-signed SSL/TLS certificate (and matching private key) for www.paypal.com.  See Could a stolen certificate show as trusted? for more info.


EFS encryption in Windows I'm trying to combine EFS encryption with VeryCrypt, system encryption.

With EFS I can choose specific files/folders instead doing a whole drive encryption, so that is the reason I use it.

I haven't deleted my certificate because I don't want to enter the password each time I log in for my encrypted folders/files. Besides I wish to encrypt files in %appdata% so they need to be decrypted by Windows once I log in.

I use VeraCrypt system encryption, so there is a password to be able to proceed with the boot. This is a security measure I combine, as Windows login password is crackable.

My question: Since my certificate is on the drive and in %APPDATA%\Microsoft\SystemCertificates (not encrypted so Windows can decrypt password less at login. And since I haven't deleted my certificate, it's stored there. My cert is backed up on a USB.), if my drive gets out of the hand, can someone extract %APPDATA%\Microsoft\SystemCertificates to use it on a different system mount my c: Windows drive, and be able to view all my encrypted files I have from EFS? Or will it ask for the certificate password during this procedure?

If you are using VeraCrypt to protect the partition that your Windows installation is on then an attacker would have to overcome that encryption before they could try to get your EFS private key.  If you're using a strong password for VeraCrypt that possibility should be low.

However, if an attacker gets through VeraCrypt and gains access to your unencrypted Windows partition then they could attempt to crack your account login password.  Once they do that they can log into your account and have access to your EFS private key and thereby all your EFS protected files.  There may be other ways to extract your private key, but this seems to be the easiest route.

Edit: removed claim that admin changing user password would allow access to private key.  See comments below.


Are these SAML NameID's equivalent? I have an application that uses SAML authentication, acts as an SP, and therefore parses SAMLResponses. I received notification that an IdP that communicates with my application will now start signing their SAMLResponses with http://www.w3.org/2001/10/xml-exc-c14n#WithComments instead of what they used to do, which was http://www.w3.org/2001/10/xml-exc-c14n.  This new method means comments now matter when calculating the validity of the SAML signature.

Here's my question - when using the #WithComments canonicalization listed above, are these NameIDs equivalent?  Or will they produce different SAML signatures?

<NameID> test@user.com </NameID>
<NameID> test <!--@user.com--> </NameID>
<NameID> test <!--@--> user.com </NameID>
<NameID> test@user.com <!----> </NameID>

This presumably is in response to https://www.kb.cert.org/vuls/id/475445.

The XML signatures will be different as the XML comments are part of the canonicalized XML that's signed.

Of course, the NameID value is test@user.com for the 1st and 4th examples, test user.com for the 2nd example and and test for the 3rd example.

The issue doesn't lie with the canonicalization method but rather with some SAML libraries which used the first text node as the NameID value rather than the concatenation of all the text nodes. For example, test@user.com could be changed to test<!--comment-->@user.com without affecting the signature and some SAML libraries would return test as the NameID.

Using http://www.w3.org/2001/10/xml-exc-c14n#WithComments would circumvent this issue but it would be still worthwhile checking whether your SAML library correctly handles embedded comments.


Can I make my Micro SD card physically unreadable if I cut the card (including its pin section) apart with scissors? I have a corrupted Micro SD card of which I saved the data already on my PC.
I want to throw the Micro SD into the waste because it is bascially useless because my Windows phone gets nuts with it. However I do not want anyone to read the data on it after coindicdentially finding it in the waste since it contains my very personal photos.

Hence I have cut the Micro SD cards into segments as it can be seen in the attached picture. The pin section of the SD cards is basically now cut in 4 parts and I want to throw one half of the segments into another waste container than the other half.

Is this an preventive action that assures no one can ever read any data from this Micro SD card again?

Being unable to read data is very different to being unable to interface with data.

You can take a CD or DVD to understand this better:

Find a disc that has been written to.
Cut the disc into 4 slices (some shredders do this).
Examine the underside. The data is still there.

While the data may still reside there, it would not be practical for someone to attempt to read it with any kind of standard disc drive.

Many enterprises and home users find "data destruction" in this fashion to be sufficient partly due to the facts:

Your data isn't the "lowest hanging fruit on the tree".
The effort to piece the disc back together just isn't worth it for most individuals.
With the volume of other media being thrown out, yours effectively blends in.

If you require a high level of assurance, the following works quite well:

Write to the media with zeros, ones, then with a random pattern.
Ensure that you pass over the media several times.
Separate the storage (platters, flash, NAND) from the controller(s).
Throw the controller(s) out unless it/they has/have a non-volatile cache.
Physically "attack" the surface and internals of the storage/controller (hammer).
Place storage/controller into a high temperature furnace or lava flow.
Take the remnants and spread randomly over a public green space.
Water said locations.


Is it advisable to have a web browser remember login credentials? I have a really long random password for my cellphone account and have it written down in a safe place. I only use it once a month and am considering having my browser remember it. Would there be any disadvantages to this? My computer is password protected so I don't see the threat.

Something I want to point out: the longer a password is the more likely a person is to make a mistake typing it in.

Make sure you use a strong Master Password, and don't forget it or lose it (Because resetting your master password will remove all of your saved usernames and passwords).

Essentially doing this means you're using Firefox as a password manager. The question now is "Is Firefox a good password manager?". Here are some answers to consider.

Alternatives: Lastpass (as mentioned) is a standalone password manager. A free and open source one I use is Keepass.


Can a compressed archive be constructed in a way to extract into system folders? Using compression utilities, is it possible to create an archive that when extracted, will place certain files in certain areas on a users PC?

For example, suppose if I wrote a virus or a malicious script, store it in a folder with other files, and zip that folder. When the user extracts the files to the provided location, they're unaware that the virus or malicious script is being copied to a system folder or somewhere deep in the C: drive.

In other words, is it possible to trick compression utilities to extract files to a location not specified by the user?

How would you minimize the damage that can done?

I'm far from being an expert, but it would seem sensible not to extract anything under an Admin level account.

is it possible to trick compression utilities to extract files to a location not specified by the user?

Yes, it's possible. And is a know problem with a catchy name: Zip Slip. It depends on the particular implementation of your extraction utility: how the extraction routine parses the destination file name.

If your unzip utility is outdated, you can be affected. On Windows, if you extract the files on D: instead of C: you should not be affected.


gpg does not require passphrase to decrypt Suddenly the behaviour of gpg has changed and my world crumbles.

I have several keys, all but one for testing purposes.  The one is my personal key.  Up to now I have been able to encrypt with this key, and I seem to remember that I had to type my passphrase to encrypt.  Now suddenly I don't.  But what is more frightening, I can double click the encrypted file and it will decrypt without asking for my passphrase.

I have googled on this, and found several suggestions, none of which works.  How do I force gpg to ask for my passphrase before it decrypts a file?  And how do I make sure that it encrypts with the right key.  I use -r  but it appears that the key doing the encryption is not my own key even if  is the name of my personal key.  I can accept that it is the recipients key which matters in encryption, but I would like my personal identity to be involved, and not the first key in the keyring.

This is due to gpg-agent temporarily caching your password. You can easily disable caching.


What's the mathematical model behind the security claims of symmetric ciphers and digest algorithms? Why can SHA-1 be considered a secure hash function? That's something I still wonder about.

I understand the concepts of why modern asymmetric algorithms are deemed to be secure. They are founded on sound mathematical problems that are provably "hard" to solve, e.g. discrete logarithms in finite fields or integer factorization. The concepts of security claims and proofs are relatively easy to follow if one is aware of the mathematical concepts.

But when it comes to symmetric cryptography and secure hash functions the picture becomes much less clear. I understand that there exist a lot of results and analysis for block ciphers and digest algorithms, but what are these results founded on?

E.g. when it comes to block ciphers you can find a lot of proofs that cipher algorithm X is resistant against a certain number of known attacks. Or they prove that some property holds, e.g. every bit of the input affects the output, because this is deemed necessary etc. etc.

From the outside, the construction of cipher and digest algorithms looks like "trying to fiddle and mess with the input as much as possible" by applying bit shifts, XORs and so on.

What I would like to know now (I would be grateful for deeper insight in either):

a) Could you provide me with pointers to resources (books preferred) that explain the design and security considerations one has to take into account when constructing a

a1) cipher algorithm

a2) digest algorithm

that would explain things such as why an S-box has to look exactly the way it does instead of any other way and probably even more important for me and my understanding why it would be bad if it were constructed differently?

b) Does there exist or are their attempts for modelling these "bit fiddling operations" mathemtically(e.g. are "algebraic attacks" based on such a model?) ?

c) How do you "measure" the quality of a digest algorithm such as SHA-1? I.e. how can you say it's better to do a shift by two bits here instead of three or an XOR, and why are these operations the basis of SHA-1 in the first place? Because at the time it seemed like the only known thing that would "maximally mess" with the input? I'm asking because it seems as if most SHA-3 candidates were either based on cipher algorithms (because there are more theoretical results) or e.g. on new concepts such as sponge functions. To me the definitions of any of the SHA algorithms (MD5 too) still look like "Let's mess with this, shall, we?" - but what's the reasoning behind it? Why do it the way they did?

I'd be more than happy if you could give me insight into any of these topics.

I can't give you an answer that is going to leave you perfectly satisfied, because there is no such answer.  How do we know that our algorithms are secure?  Strictly speaking, we don't.  We have no proof that SHA256, or AES, or RSA are secure -- it is widely believed that they are secure, but I could not give you a mathematical proof of that fact, and who knows, it is always possible that widespread beliefs are wrong.

Our belief in the security of these algorithms comes from the fact that a lot of really smart, knowledgeable people have tried really hard to break these algorithms, without making much of a dent at all.  Of course, this is not a guarantee that no clever attack exists -- it is always possible there is some incredibly sneaky mathematical shortcut attack that no one has been clever enough to find, but the more people who try to find one and fail, the less likely that looks.  For practical purposes, it seems unlikely that a garden-variety attacker is going to discover an attack that dozens of really smart people tried to find and failed.

Your immediate reaction might be, what the heck?  Why are those cryptographers so lame?  Why can't they prove any of their algorithms secure?  Are they numbskulls?  The answer is, there are fundamental reasons that make it very difficult to prove that an encryption algorithm or a hash function is secure (except in special cases).  Roughly speaking, proving that an algorithm like AES or RSA or SHA256 is secure seems likely to be at least as hard as proving that P != NP (an infamously hard problem in computer science).  We have very few tools for proving that an algorithmic task can not be completed efficiently.  At its core, this is what makes it hard to prove that SAT cannot be solved in polynomial time (i.e., hard to prove that P != NP), and makes it hard to prove that there is no shortcut attack on AES (i.e., that AES cannot be broken).  So it's not just that cryptographers are lame, it is that we are up against very hard problems that no one knows how to make progress on.

Note that nothing I said above is specific to hash functions, or to symmetric-key cryptography.  It applies to all computationally-secure cryptography, including symmetric-key encryption, public-key encryption, digital signatures, hash functions, and many other standard primitives that we take for granted.

Your last question was: Can anyone teach me the theory of how symmetric-key algorithms are analyzed and cryptanalyzed?  How do cryptographers analyze them?  How do attacks work?  No, I cannot teach you this within the time and space constraints here.  There is an entire research field built up around these questions, with an intellectually deep literature on techniques for analysis of symmetric-key algorithms.  (See, e.g., the FSE, CRYPTO, and EUROCRYPT conferences.)  It takes years of dedicated study to learn this material.  Unfortunately, I cannot teach you all of that in the space available here.  The very short version is: cryptographers have developed a large suite of attack techniques, and as a starting point, any new primitive is first analyzed to see if any of those attacks will work.  If the primitive resists all of the known attack techniques, then cryptographers spend time trying to design ad-hoc or custom attacks against the primitive.  Cryptographers also study artificially-weakened versions of the primitive (e.g., with fewer rounds), to learn about the best attacks on those weakened versions in an attempt to extrapolate to the full thing.  If after many person-years of effort, no one is successful in attacking the scheme, then people start to gain more confidence.  More recently, there has also been some research on gaining confidence that the high-level structure is sound, or that all attacks of a particular class are guaranteed to fail, using ideas from the provable security community.

But at the end of the day, it is an art as much as a science.  Vetting a new primitive is extremely expensive: it takes person-decades of effort from intensely-talented specialists.  For this reason, smart users of cryptography generally try to use existing, vetted primitives, rather than inventing their own.  If you invent your own scheme, it is extremely unlikely you'll be able to arrange for as much analysis and vetting of your own scheme as the standard ones have already received -- so don't do that.  Don't "roll your own".  Instead, build on existing, standard, accepted primitives, like AES, SHA256, RSA, etc.


Hashing a credit card number for use as a fingerprint What's the best way to hash a credit card number so that it can be used for fingerprinting (i.e. so that comparing two hashes will let you know if the card numbers match or not)?

Ideally, I'm looking for recommendations of which hash + salt might be well suited for this use-case. The hash would uniquely identify a particular card number. You can use this attribute to check whether two customers who've signed up with you are using the same card number, for example. (since you wouldn't have access to the card numbers in plain text)

To give this some context, see the Stripe API docs and search for fingerprint. It's where I first heard about this concept. The credit card information will be stored on a secure machine (somewhere in the Stripe back-end) that's not accessible by the customer, and the API returns the fingerprint in order to allow the API consumer to make comparisons (e.g. to answer questions like has this card been used before?).

Let's make this one clear, coz I know you're going to ask: I'm not trying to replicate it. I'm just curious to understand how this could be implemented

Ok, so if this is a business requirement that you must meet (check to see if a card already exists in the system) this is how I would do it.

First, PCI-DSS does allow for a PAN (the primary account number, or credit card number) to be stored in hashed form using "strong cryptography" and they recommend (but do not require) that a salt be used as well.  PCI-DSS v3 § 3.4(PDF link)  The reason is to inhibit the ability of a malicious party who gets ahold of the hash from determining the PAN that was used as the input for the hash.

Second, your plan to store this in a separate, secure system and expose it only via an API is a good defense in depth measure.  If I were implementing this, I wouldn't have it send a hash back to the primary system, I would simply take the hash as a parameter for the API call and have the API return "true" or "false" depending on whether the hash already exists in the system or not.

For the hashing function, the key to preventing the recovery of the inputs (as required by PCI-DSS) is to chose an algorithm that allows you to make the process computationally hard, so the task of brute-forcing the relatively small input space of valid PANs reasonably slow.  SHA-512, suggested by another answer, is not this algorithm.   Looking at the test matrix for hash cracking provided by hashcat.net the fastest machine in their matrix  can calculate nearly 2 billion SHA-512 hashes per second.  With an estimated input space of approximately 30,000,000,000,000 cards**, that means that unsalted, you could compute the SHA-512 of each of those PANs in just over 4 hours, and have the card numbers for ever card in the database, should it ever be stolen.

So, what we need is a slow hash function, however the definition of slow changes all the time as computers get faster and technology evolved.  This means that a secure hash function will be one with an adjustable work factor, so over time you can increase the computational effort required to compute the hash of a given input.  There are several candidate algorithms that meet this criteria including PBKDF2, bcrypt, and scrypt.   The general consenus for password hashing is bcrypt, and that is what I would suggest here.  For the cost, set it as high as your application allows.  It likely isn't something you're going to be computing terribly frequently (I'd imagine, depending on your application, you're going to be looking at x hashes per minute or hour or day rather than per second) and the higher the cost, the harder it will be for an adversary who captures the hash to brute force.

** My estimate is based on a 9 digit account number, a computable check digit that doesn't increase complexity and a WAG of 30,000 active bank identification numbers (the first 6 digits of the card) based on a list I found.


False negative in biometrics In biometric systems preventing false positive is usually far more important than preventing false negatives. In what situations can false negatives be more serious than false positives?

A false negative is when biometric systems fail to recognize an authentic individual, which would lead to something not happening. Depending on what that something is there could be various consequences:

Personal: An owner of a safe may be prevented from accessing that safe, leading to him/her being unable to access a necessary resource. Say they really need the money that's in there
Institutional: Say my entire server infrastructure is down, I need to access my data center to restore service. Ever minute is losing my company thousands of dollars in revenue. The biometric system doesn't recognize me, therefore the company loses more money and reputation
Safety: A staff member in the datacenter collapses on the floor in cardiac arrest, the biometric system doesn't recognize me when I try to go to her CPR. She could die before I get to her


Wireless and MAC Spoofing of AP's Today I observed some strange behavior with an IP address on our network. Our main switch was reporting that it's MAC address kept changing, a couple times every minute. We pinged the IP repeatedly and cleared the ARP cache and with every clearing of the ARP we saw a new MAC entry.

We tracked it for some time and it seemed to be cycling through the MAC addresses of our wireless AP's. Every couple of seconds it would take the MAC of a different AP, and just keep going.

Has anyone seen behavior like this before? We tried everything we could think of try and track down the culprit but so far we have had no luck. How would one go about setting something like this up? And how can we track down it's origin?

Cheers

The IP that is switching MAC address is simply spoofing its MAC address repetively.
If you want to identify the machine spoofing it's mac adress, you could read up on this user suggestion :
https://stackoverflow.com/questions/9546228/how-to-detect-the-original-mac-address-after-it-has-been-spoofed


Different certificate information for the same website? Apologies for the funny title, I'll try to give a better explanation here :) I have just noticed something weird with regards to a website certificate: if I go to https://www.anobii.com/login using Firefox on my PC everything works and the certificate is validated.
If I visit the website on my phone, using Dolphin Browser in 3G, I get the following warning:

How can a certificate contain different information on two different devices?

It looks like anobii.com are making use of a content distribution network CD Networks.  Visiting that page the SSL certificate for static.anobii.com is goes to support5.cdnetworks.net.

So the main content is being served with an ordinary certificate but some of the other content is being served with an invalid certificate, which is what I think is causing your error.  what's interesting is that firefox doesn't alert if you go to the main page, but if you pick a resource on that page which is being served from CD Networks and browse directly to that (e.g. https://static.anobii.com/favicon.ico ) you get an SSL warning as below

As to why Dolphin is warning you and firefox isn't, my guess is that it could be difference in how they handle SSL warnings


Vulnerability test for CVE-2014-2483? I am in penetration testing on a server with Linux RHEL6/7 os. Vulnerability databases such as http://www.cvedetails.com/ mentioned the vulnerability CVE-2014-2483 for Java in Linux RHEL systems. I searched for the way that I can test my destination for the vulnerability, but I didn't find anything.

How can I test my server for this vulnerability?

The best/most accurate way to test for things like this is in a white-box security assessment approach, by checking the version of Java installed on the system. So on a redhat system something like rpm -qa would provide the version installed, then check the changelogs for the package which should list what CVE's have been addressed.

To automate that, something like Nessus can be used with credentials to provide info. on what outdated packages are installed on a system.

If you're trying to do this "black box" they you'd need to dig into the exact details of the vuln (which may well be tricky if there has been no disclosure of the technical details, which is the case with many issues) and then see if it's remotely exploitable.


Does DirectAccess protect non corporate traffic on public wifi? If I were connected to DirectAccess over public wifi, does this provide any measure of security for non-corporate resources, such as online banking?

Would I be better served by going through corporate VPN if I had to access online banking in public?

Finally, could a university wifi network ever be considered reasonably secure even if it is on WPA2-Enterprise? (ie. is it as secure as a corporate WPA2-Enterprise at the office, or my home wifi?)

Thanks in advance for the help.

By default, no.   DirectAccess enables split-tunneling by default, so only requests for corporate network resources will be protected by the VPN, and all other requests will be handled by the local network, so requests for things like online banking sites will only be as secure as they would otherwise be on the network you're using, as if DirectAccess wasn't connected at all.

Additionally, I don't believe that split-tunneling is an end-user configurable option with DirectAccess.  I believe it's administrator configured.  I don't see a setting for it on my machine in any case.

You final question is likely unanswerable. Could a university network be as secure as a corporate or home network?  Sure, why not?  They use much the same technology after all, and many home wifi networks, at least, are horribly insecure.  However, that says nothing about the security of a specific network, so is effectively useless information.


Enter the password outside the password field If I press Tab twice after enter my username, I will type my password somewhere outside the password field.

Are there any chances for somebody to catch my password when I enter it outside the password field?
I thought about a badly placed Web banner or something like that, which is waiting for this mistake.

I can see a similar question here, but that relates to the password being entered into the username field.

I see two possible problems with this:

Browser/Application Autocompletion

If you do it in a web browser, and the field you enter the password in can allow data to be stored by the browsers autocompletion - then people with access to the browser can find your password. Either by chance, or intentionally. If you enter passwords in a password field, it should not be stored by autocompletion - but in the password database (if opted in).

Server side logs

In the related question you posted a link to in your question, the username field is often found in logs - and possible logs that are accessibly to multiple users. For other fields, it is entirely up to the application and what it does with other input fields.


How can I detect that steganography has been used? I have seen some of the algorithms which are used to detect if a file is a stego-file or not, but all those algorithms check for specific patterns and are not universal. Maybe there are universal detection systems, but I have not seen them yet.

Situation:
When a message is hidden in an image, I want to check for all the possible ways that it may be a stego-file - given that I don't have the original file.

Problem:
I have no idea where to start.

Any help will be appreciated. Thanks

There can be no universal algorithm to detect steganography.

You can implement a series of tests against every known specific steganographic system in existence.  But an attacker can use that as a test to develop a new form of steganography that bypasses all existing tests.

What you'll need to do is start researching all the various known forms of stenography in existence today, and provide tests that identify each one.  Least Significant Bit is just one of dozens of known techniques.

Alternately, you can look to tools that others have developed.  See outguess.org for a ten-year-old project that tried to do something like this.  One novel thing the authors of stegdetect did was to be able to provide a set of plain images, then include samples of those images known to contain steganography.  Using linear discriminant analysis, they are able to create a detection function based on the differences.


Is there a reason why legit web sites are using this type of obfuscation? Saw some top 200 web sites (by Alexa) using obfuscation in the javascript code.  Any ideas on why they do it? My guess is that they do it to prevent data scraping, but not sure.  Thanks.

youtube

Booking.com

It's not obfuscated script. it's only minimized script for faster loading purposes.

These are some sample scripts.

Normal Script:

StackExchange.ready(function() {
    StackExchange.using("postValidation", function() {
        StackExchange.postValidation.initOnBlurAndSubmit($('#post-form'), 2, 'answer');
    });

    StackExchange.question.init({
        showAnswerHelp: true,
        totalCommentCount: 2,
        shownCommentCount: 2,
        highlightColor: '#F4A83D',
        backgroundColor: '#FFF',
        questionId: 128839
    });
    styleCode();
    StackExchange.realtime.subscribeToQuestion('162', '128839');
    StackExchange.using("gps", function() {
        StackExchange.gps.trackOutboundClicks('#content', '.post-text');
    });
});

Minimized Script:

StackExchange.ready(function(){StackExchange.using("postValidation",function(){StackExchange.postValidation.initOnBlurAndSubmit($('#post-form'),2,'answer')});StackExchange.question.init({showAnswerHelp:true,totalCommentCount:2,shownCommentCount:2,highlightColor:'#F4A83D',backgroundColor:'#FFF',questionId:128839});styleCode();StackExchange.realtime.subscribeToQuestion('162','128839');StackExchange.using("gps",function(){StackExchange.gps.trackOutboundClicks('#content','.post-text')})});

Obfuscated Script (using my self method):

var _0x1fc5 = ["\x30\x2E\x38\x28\x31\x28\x29\x7B\x30\x2E\x33\x28\x22\x34\x22\x2C\x31\x28\x29\x7B\x30\x2E\x34\x2E\x39\x28\x24\x28\x27\x23\x35\x2D\x61\x27\x29\x2C\x32\x2C\x27\x62\x27\x29\x7D\x29\x3B\x30\x2E\x63\x2E\x64\x28\x7B\x65\x3A\x66\x2C\x67\x3A\x32\x2C\x68\x3A\x32\x2C\x69\x3A\x27\x23\x6A\x27\x2C\x6B\x3A\x27\x23\x6C\x27\x2C\x6D\x3A\x36\x7D\x29\x3B\x6E\x28\x29\x3B\x30\x2E\x6F\x2E\x70\x28\x27\x71\x27\x2C\x27\x36\x27\x29\x3B\x30\x2E\x33\x28\x22\x37\x22\x2C\x31\x28\x29\x7B\x30\x2E\x37\x2E\x72\x28\x27\x23\x73\x27\x2C\x27\x2E\x35\x2D\x74\x27\x29\x7D\x29\x7D\x29\x3B", "\x7C", "\x73\x70\x6C\x69\x74", "\x53\x74\x61\x63\x6B\x45\x78\x63\x68\x61\x6E\x67\x65\x7C\x66\x75\x6E\x63\x74\x69\x6F\x6E\x7C\x7C\x75\x73\x69\x6E\x67\x7C\x70\x6F\x73\x74\x56\x61\x6C\x69\x64\x61\x74\x69\x6F\x6E\x7C\x70\x6F\x73\x74\x7C\x31\x32\x38\x38\x33\x39\x7C\x67\x70\x73\x7C\x72\x65\x61\x64\x79\x7C\x69\x6E\x69\x74\x4F\x6E\x42\x6C\x75\x72\x41\x6E\x64\x53\x75\x62\x6D\x69\x74\x7C\x66\x6F\x72\x6D\x7C\x61\x6E\x73\x77\x65\x72\x7C\x71\x75\x65\x73\x74\x69\x6F\x6E\x7C\x69\x6E\x69\x74\x7C\x73\x68\x6F\x77\x41\x6E\x73\x77\x65\x72\x48\x65\x6C\x70\x7C\x74\x72\x75\x65\x7C\x74\x6F\x74\x61\x6C\x43\x6F\x6D\x6D\x65\x6E\x74\x43\x6F\x75\x6E\x74\x7C\x73\x68\x6F\x77\x6E\x43\x6F\x6D\x6D\x65\x6E\x74\x43\x6F\x75\x6E\x74\x7C\x68\x69\x67\x68\x6C\x69\x67\x68\x74\x43\x6F\x6C\x6F\x72\x7C\x46\x34\x41\x38\x33\x44\x7C\x62\x61\x63\x6B\x67\x72\x6F\x75\x6E\x64\x43\x6F\x6C\x6F\x72\x7C\x46\x46\x46\x7C\x71\x75\x65\x73\x74\x69\x6F\x6E\x49\x64\x7C\x73\x74\x79\x6C\x65\x43\x6F\x64\x65\x7C\x72\x65\x61\x6C\x74\x69\x6D\x65\x7C\x73\x75\x62\x73\x63\x72\x69\x62\x65\x54\x6F\x51\x75\x65\x73\x74\x69\x6F\x6E\x7C\x31\x36\x32\x7C\x74\x72\x61\x63\x6B\x4F\x75\x74\x62\x6F\x75\x6E\x64\x43\x6C\x69\x63\x6B\x73\x7C\x63\x6F\x6E\x74\x65\x6E\x74\x7C\x74\x65\x78\x74", "\x72\x65\x70\x6C\x61\x63\x65", "", "\x5C\x77\x2B", "\x5C\x62", "\x67"]
eval(function(_0x5f63x1, _0x5f63x2, _0x5f63x3, _0x5f63x4, _0x5f63x5, _0x5f63x6) {
        _0x5f63x5 = function(_0x5f63x3) {
            return _0x5f63x3.toString(_0x5f63x2)
        };
        if (!_0x1fc5[5][_0x1fc5[4]](/^/, String)) {
            while (_0x5f63x3--) {
                _0x5f63x6[_0x5f63x5(_0x5f63x3)] = _0x5f63x4[_0x5f63x3] || _0x5f63x5(_0x5f63x3)
            }
            _0x5f63x4 = [function(_0x5f63x5) {
                return _0x5f63x6[_0x5f63x5]
            }];
            _0x5f63x5 = function() {
                return _0x1fc5[6]
            };
            _0x5f63x3 = 1
        };
        while (_0x5f63x3--) {
            if (_0x5f63x4[_0x5f63x3]) {
                _0x5f63x1 = _0x5f63x1[_0x1fc5[4]](new RegExp(_0x1fc5[7] + _0x5f63x5(_0x5f63x3) + _0x1fc5[7], _0x1fc5[8]), _0x5f63x4[_0x5f63x3])
            }
        }
        return _0x5f63x1
    }
    (_0x1fc5[0], 30, 30, _0x1fc5[3][_0x1fc5[2]](_0x1fc5[1]), 0, {}))

See, those 3 scripts above are same (equal).


Is there a way to find out how long it takes John the Ripper to crack a particular password? I am looking to test/demonstrate things like: when the supplied wordlist contains "abc123" and pw="abc123" then John cracks the pw in 1/2 a second... but if word list does not contain "abc123" John takes 5000 seconds to crack the pw.

John --test myPwFile does not seem to do what I want it to do.

The important thing to understand is that password cracking time is an average. The attacker will try a lot of passwords, and may be lucky... or not. John the Ripper will use the provided word list, and then try "variants" of the said words, in some order which may or may not be representative of what an attacker will do.

If your password is chosen "at random" (uniformly) in a set of N possible passwords, then the average attack time will be the time it takes to compute N/2 hashes (with whatever hash function is used in your specific situation). This means that if you generate one million such passwords, and each time get the attacker to crack the chosen password, and then sum up all the times taken and divide by one million, then you will find that average times. Sometimes the attacker was faster; sometimes he was slower.

Or, said otherwise: no, John the Ripper is NOT the much fabled "password meter" which will give an absolute "strength value" to your password. The strength of a password is a property of how you generate it, not of the password itself. For any given password, you can only reason on averages and pray for the best.

The whole idea is that a password which is sufficiently random (more correctly, a password which is generated from a sufficiently random process) will bring the probability of an attacker getting lucky sufficiently low to be neglected (if the attacker has only one chance in 14 millions to get the password within one week of computations, then you can even out the chances by buying a lottery ticket, which has one chance in 14 millions to make you rich enough to ignore those trivial matters of stolen passwords).


Exposure Factor when calculating SLE I am studying for an exam and came across a question asking to find what the single loss expectance would be, but I am failing to understand exposure factor in the calculation.

SLE = Asset Value * exposure factor

The question:
Your company owns a machine that is worth $100,000, if it was damaged in a fire it would only be worth $8,000 in parts. What would the single loss expectance be?

My thought is that since the machine is $100,000 and you can only salvage $8,000 then the answer should be $92,000. You are expected to lose $92,000 when a fire occurs.

The answer they give is that SLE = $8,000. This doesn't make sense because you aren't losing $8,000, you are losing $92,000.

Can someone please explain why SLE is $8,000 and not $92,000?

Exposure factor is a percentage: the percentage of the value that would be lost if a loss occurs. If the asset is completely lost, then the EF = 1.0

Let's redo your formula with a total loss:

SLE = AV * EF
SLE = $100 * 1.0
SLE = $100

But in your book, you are expected to lose 92%, so:

SLE = AV * EF
SLE = $100 * 0.92
SLE = $92

You can see that the more you "lose" in the event, the higher the exposure factor is, and the higher the SLE becomes.

The calculations are as you expect. I'd check your book's errata ....


How to mitigate risk of leaking information of a user not found in database during login As far as I understand the process of logging someone into your system goes like this:

1) The user which wants access transmits credentials to your system (typically login - being a unique identifier - and password)

2) The system uses the login to retrieve the account information from a database comprising a passwordhash to compare against.

3) If a user was found, the transmitted password is hashed and the hash is compared against the hashed password from the DB.

4a) If both match access is granted

4b) If both do not match access is declined

Whereby the process of (2) leaks the information of a login existing in your system or not (via time).

My question is twofold:

a) Is this risk of leaking the information worth mitigating?

and more interesting:

b) How to mitigate that risk?

Timing step 2 does leak information. In order for it not to, you'd need a database implementation where hits and misses take the same amount of time.

It is probably more important, though, that you run step 3 unconditionally. If a username is not in the database, then use a dummy value for the salt and execute your password hash using the same configuration you use for real accounts.

Step 2 would probably require more than one login request to "average out" noise from timing data. Conditionally executing step 3 would make timing attacks trivial.

I'm not familiar with real world database implementations. (Or their indexing options.) My guess is that no major DB supports a constant time indexing mode. There might be indexing options that are closer than others to being constant time.

Hash-table-based indexing schemes that don't use bloom filters or caches might be one of the least bad options. Perhaps there is some type of index that will only ever do one disk seek for any key lookup.

Hit and miss times after the disk-seek will still vary, but then hopefully it won't vary by much. Precise timing then might be made more difficult by other unpredictable sources of timing variability. (Seek times, server load, or network conditions, for example.)


Can I get the forwarder IP from the WAF? (when a website redirects a user, and I want the website's IP) I guess that I'm sending a token to a web server, they use my token to redirect a user to my website and the user uses my website.

Now, using a WAF and setting x-forwarded-for I can get the IP of the user, but how can I confirm that the same web server has sent the user, not passing the token to another web server, and then the second server redirected the user to my website?

I want to be able to check if the user has come from the same server that I have sent the token for.

The HTTP Referer header is generally used to identify which website forwarded a client browser to the current site.  It only reflects the last link in the chain.

However, as with anything submitted by the client, you cannot rely upon it for security purposes.  It may not be included as a matter of browser policy, such as with Firefox Private Mode (but not Chrome Incognito).  Non-private-mode browsers may still allow the user to turn it off via settings or via extensions.

It might be possible to have the other web server set something for you via CORS, but that presumes you'd be working pretty closely with them, which I don't get the sense of from your question.

Other than that, there's not much you can do.  Your WAF will only see the connection from the client to you, and cannot know anything about previous connections the browser made.


Security test within a staging environment. Is SOAPUI sufficient as a test tool? Currently I am working on a project in which I am supposed to define the following aspects as a test manager:

Conception of a penetration test for a test staging environment
Planning security guidelines for REST API development
Use of REST API scans via SOAPUI (create security test cases)

So my planning within the staging environment includes functional test procedures, integration test, as well as test procedures on the RESTAPI level.
I am however undecided whether the pure security test about the SOAPUI solution alone is enough to get a high security coverage.

Therefore I plan another possibility in the test environment with even more special tools which besides the RestAPI level also :
Integration of W3af or Vooki into the staging environment.

Questions:
Is a security test drive via SOAPUI sufficient ?
Should I use a different tool in the Stage (Pre Production) and in the Production?
Should I test Security Test with another tool within the staging environment?

SOAPUI is a good tool to execute a DAST (Dynamic Application Security Testing).
Another good open source tool is OWASP ZAP. There are also a bunch of commercial ones.

It's not the tool you are testing with, but the web attack payloads it runs against your application. If two of the tools have the same web attack payloads, there is no need to use another one.

You could also potentially do tests like SAST (Static Application Security Testing) which analyzes your source code for vulnerabilities before deployment or SCA (Software Composition Analysis) which would check for vulnerabilities in your third party dependencies you are using.


Emailing Medical Records Securely Some doctors' offices give a personal email address, like Yahoo! or Gmail for patients to email medical records. What questions should I be asking them to make sure the email account is secure? Even if they supply an email address associated with their website, doesn't mean it's secure.

There are no questions you can ask to make sure it's secure, because it simply isn't. Email is often encrypted, but that's only part of the story. Due to the way email works, it may be encrypted between servers, but each server between you and the destination will have a plaintext copy (ie the encryption isn't end-to-end). Even worse, email encryption is almost always opportunistic, so if there is an active attacker they can downgrade it to plaintext.

Emailing medical information is generally a violation of HIPAA in the US, and probably other laws in different jurisdictions (an exception is emailing within a company or between companies that have a way to guarantee encryption is used between their servers).


How to connect HackRF to Wireshark? How to capture ZigBee waves using HackRF and how to analyze it through Wireshark?

Before RFTap was made available recently, you would have to configure a named pipe from GNURadio pcap output.

Which protocol(s) are of interest to you for this purpose?


Bypassing x-frame options possibility discussion This has something to do with a different post I made:
Other post

While researching this a bit further I found the following blogpost: blog elev

As I understand it this guy reads all content of a website and then displays it in his iframe. This way the x-frame-options is circumvented and the site can be displayed. He uses this functional to test something or the other.

This got met thinking about the security implications of this.

Consider the following scenario:

I have a site with a login page and I set the x-frame-options to SAMEORIGIN as I do not want to be vulnerable to clickjacking attacks
An attacker makes a site as in the blogpost and puts all content of my site into an iframe like reported in the blogpost. He then puts an invisible iframe on top of that, which he will use to gather whatever the users will put into the login form.
An attacker then tricks a user to click on his link to a site that has an url similar to mine (e.g. mys1te.com).
The user thinks it is my site and logs in
The attacker has the credentials of the user

Isn't this a clickjacking attack? And if so isn't this then a way to bypass the x-frame-options? And then if so, what can be used to make a 100% sure no clickjacking is possible?

I am trying to find the holes in this story.

As I understand it this guy reads all content of a website and then displays it in his iframe.

He literally downloads the site's content and prints it out on his own page. This means that the content he downloaded afterwards belongs to his own domain.

But whole the idea of a clickjacking attack is that you embed a site from a different origin in a frame. For example, a  simple clickjacking attack could be that I embed https://facebook.com/ in a hidden frame on my site and I position the frame in a way that as you click anywhere on my site, you actually click inside the frame and, say, involuntarily like one of my Facebook posts. Obviously, Facebook prevents this scenario by supplying an X-Frame-Options: DENY header.

However, if I proceed as in the blog post and download the Facebook page to my own domain to then embed it in my own frame, that would be pointless because clicking around in my downloaded copy of the page would not trigger any action on the real Facebook site.

  An attacker then tricks a user to click on his link to a site that has an url similar to mine (e.g. mys1te.com).
  The user thinks it is my site and logs in

What you describe sounds more like a phishing attack. Copying the content of a different page and making it look similar to the original will always be possible.


Can you help me with some misconceptions about bcrypt and salting? I researched password hashing and cracking and I have some misconceptions:

First rule of thumb to create a strong password is to use 10+ combination of digits/upper/lower/symbols to prevent brute force attacks.
Then the problem will be only if the password is a member of a pre-made table (whether it was long or short password).

Let's say the password is QWERTY and assume that:

Hash(QWERTY) = $$$$

User1: Hash(QWERTY+134565654) = ####

User2: Hash(QWERTY+876964786) = &&&

And let's think about how salt will help:

For brute force:

The unsalted one $$$$ is easy to brute force

The salted ones #### and &&& are harder to brute force because they are longer and even if they were brute-forced the hackers won't know the password unless they have the salt

For rainbow tables:

The unsalted one is easy to look in rainbow table with $$$$

The second one when you look for a rainbow table for #### you won't find anything

For rainbow tables, if the hacker has the salt when he broke the database:
The hacker has #### and has 134565654
The hacker will need to implement a new rainbow table for all the known passwords with appending 134565654 to them until he finds that #### matches QWERTY+134565654 and knows the password

Since every user has their own salt, cracking User1 password from creating a 134565654 specific rainbow table, won't help the hacker to know that User 2 has the same password, so the hacker will need to do another 876964786 specific rainbow table for this user

It takes longer time to crack 1 password but isn't it still feasible with modern GPUs allowing to create fast Rainbow tables?

For Bcrypt:

Unlike the previous example (where the salt would be stored in a separate column for example) bcrypt computes the salt through rounds (say 10), so it runs the slow bcrypt hashing algorithm 10 times on the password before storing in the database and before verifying user login.

Since the bcrypt algorithm is known, why wouldn't hackers create a bcrypt rainbow table for each round? So this way they will create just 31 bcrypt rainbow tables for the common and short lengths passwords?

If what I'm saying is true, does this mean that salting helps only against brute force without salt value exposed, but doesn't really help against strong GPUs with the salt value?

The salted ones #### and &&& are harder to brute force because they are longer and even if they were brute-forced the hackers won't know the password unless they have the salt

Brute forcing is commonly an offline attack. For online attacks the time it takes for password verification are generally too long. Moreover, countermeasures should be in place to disallow a high number of guesses (maximum retries, deliberate delays).

The offline attack is generally over the hash and the salt, because they are stored together in the database.

The extra size of the salt (which is commonly mixed in differently than simple concatenation) should not be seen as much of a hurdle.

  The unsalted one is easy to look in rainbow table with $$$$

Well, if the password is indeed really strong, then it may be that the rainbow table doesn't contain it, so it might fail.

  The second one when you look for a rainbow table for #### you won't find anything

Indeed, not if you don't have a rainbow table for a particular hash.

  It takes longer time to crack 1 password but isn't it still feasible with modern GPUs allowing to create fast Rainbow tables?

You're missing the point here. Rainbow tables are useful for matching multiple passwords against the rainbow table. Rainbow tables are useless to check only one password against. If the salt is unique (e.g. if you use a 128 bit random salt) then rainbow tables have no use.

Rainbow tables make it possible to efficiently store a hash -> password table. The adversary still has to create it by hashing each password guess separately.

  Since the bcrypt algorithm is known, why wouldn't hackers create a bcrypt rainbow table for each round? So this way they will create just 31 bcrypt rainbow tables for the common and short lengths passwords?

The input for finding a password in a rainbow table is the hash output. The intermediate hash outputs of the rounds before the last one aren't stored. So how would you lookup a password using them?

  If what I'm saying is true, does this mean that salting helps only against brute force without salt value exposed, but doesn't really help against strong GPUs with the salt value?

No, salting does not help against brute force but it helps against rainbow tables.

If you use a secret as part of the salt it is called a pepper. The pepper can act as a symmetric key; as long as the pepper contains enough entropy then there is no way to check if a password would create a specific hash. A 128 bit / 16 byte pepper generated by a secure random number generator should contain enough entropy.