How secure is using this (p3 Python) module to encrypt a file? I've recently been looking for a good (enough) method to encrypt files, and I came across this thing. It says that it's a

  Simple p3 encryption "algorithm": it's just SHA used as a stream
  cipher in output feedback mode.

Honestly I don't know what much of that means, other than I know SHA is a hash function. The first thing I know about encryption is that creating a good algorithm is hard. Which is why I'm not doing something silly like rolling my own simple XOR encryption.

If I use a 10-20 character passphrase with this program, how secure would my files be?

Making your own crypto algorithm is considered a bad idea unless you are a cryptographer and are willing to spend a lot of time creating/testing it.

The algorithm in P3 is (according to the mailinglists) created by a guy who knows his stuff, but it's not a standard. I suggest using AES instead if you want to use passwords (AES is a symmetric encryption algorithm).

The problem at the moment is that there are no readily available modules for Python 3 that come with AES support. For Python 2.x there is Pycrypto, an excellent library for any cryptographic algorithm, but it's still getting ported at this time to Python 3. However there is a branch that already contains AES here.

Now how tough would it be to crack AES with a 10 to 20 character password? Very tough. If you use the most secure one (which is AES 256 at the moment) and your password consists of only numbers,upper and lower case letters. Then you would have (26+26+10 possibilities for one letter)^10 (all possible combinations). This is a huge number of passwords you'd need to try (statistically half the amount actually). Because of the complexity and CPU load AES can cause, it would take over one hundred thousand years to crack it.


How to backup files stored in a possibly infected computer? I am to reinstall an old Windows XP installation. Before I format the drive, I have to backup some data (~200GB) like .doc files, pdfs, photos to an external hard drive. My concern is that this installation might be infected. My presumption, or rather fear, is that if it is infected, the infection might live on in the backups. What would be the best way to backup these files so as to minimize chances of carrying over an infection?

A first point is that the files shall be copied under some protection. When you boot up an infected system, malware and virus present on the system may be activated, and then try to propagate, for instance into other files on an external hard drive.

Infected files are said such because of their ability to "infect" computers which look at them. Precisely, a virus in a file fools a computer which "opens" the file into executing its nefarious code. This fooling uses vulnerabilities in the software used to interpret the file contents. Unfortunately, running weak software can be quite automatic: for instance, if you use a Windows system to have a look at some files in a directory, then the file explorer will show miniature versions of pictures. This means that there is a part in the file explorer application which automatically reads and interprets the picture file contents. Any vulnerability in that interpreting code will allow a virus to propagate, even if you, as a human user, do not actively open any of the files.

Ideally, you would like to first copy the files from a completely distinct operating system, e.g. Linux (under the assumption that a Windows virus won't harm Linux, and vice versa). You could boot from a CD or USB stick a Linux system (e.g. Ubuntu's desktop edition install CD is also a usable OS which can work off the CD without installation). Alternatively, open up the Windows machine, extract the hard disk, put it in a USB hard drive enclosure, and plug it into a Linux machine.

Then, the files ought to be scanned for known viruses. There is never any guarantee that all infections will be detected by any antivirus, but they can still help. In particular, if you keep the old Windows XP out of any network contact, or (even better) simply shut down for a fortnight, then any virus on it will be necessarily at least two weeks old, giving more chance for antivirus to have caught up with it and to successfully detect it.

If you are still wary of virus, you may apply some transcoding on files. For instance, a JPEG picture can be converted to PNG, then back to JPEG. Even if the original file includes some sort of virus, the conversion from JPEG to PNG will remove it, if the converter application is not itself vulnerable (i.e., do that from the Linux system with which you copied and scanned the files). Transcoding can incur some information loss; Word files would be problematic.


Risks of allowing employees using personal GitHub accounts for work Proprietary software developed by a (smallish) company is stored in the company's GitHub private repository. For work, software engineers are requested to create company-specific GitHub account bound to their work email address.

But access to the private repository can be granted or revoked independently from the "account origin". What can be the risks of using personal (i.e. associated with an email which is not related to the company) GitHub account by developers?

Edit: I see one potential risk: if the account is used also for other things than work, its SSH key is likely to be saved also in places where these "other things" are done. This is a potential threat to work repositories; with a dedicated account, it's easier for the developer to keep the key(s) only in work-related (maybe controlled) environments.

Are there any other specific risks?

The general rule of thumb is to only allow business accounts access to business assets.

If an employee is let go, there are a lot of different access rights to remove. If I was an employee and had to register for access, I would need to let someone in charge know that my personal email fluffybunny@gmail.com was me, and was allowed access. Then when I was "decruited", someone would have to look up who I was on Github and remove that access by hand.

By using official business email, the relationship between the email and the person is set and reliable, and then revoking access is straightforward. It could even be automated.

The other aspect is that all the commits and notifications, which can contain sensitive info, is not going to a non-business account.

"But, but, I could have access to this stuff through my personal account if I did X, Y, Z!" Yes, but that's you violating policy/intent and that's on you. The business needs to set the tone by doing things like enforcing the separation of business and personal communications and access.


What's to stop someone from 3D print cloning a key? My friend just posted a picture of her key to instagram and it occurred to me that with such a high res photo, the dimensions of the key could easily be worked out.
Therefore the key could be duplicated.
What's to stop someone malicious from abusing this?

The simple answer is: nothing.

This has already been done for many years, with keys being cast or created from blanks using hand drawn copies, photographs, remembered shapes etc all being successfully used, both by locksmiths and criminals.

A 3D printed key will do just as well, if strong enough, or it could be used to cast a key if necessary, or as pointed out by @EkriirkE - you could use a torque bar to turn the barrel.

You should not ever post picture of keys to a public site, unless it is for something unimportant.


Is a Captive Portal Wifi AP as insecure as an open unencrypted Wifi? As far as I understand, the captive portal is implemented by some sort of iptable firewall rules. Since there is no handshake established during the initial association with the AP(As no passphrase is required), does it mean that all subsequent traffic will be sent unencrypted even after the user has authenticated via the captive portal?(Which means that an attacker can sniff all traffic and inject arbitrary packets)

Yes, wireless networks protected only by a captive portal are unsecured. They work by denying access to websites other than the captive portal until the connected device, identified by MAC address, has clicked through the portal. Requests to non-HTTPS sites made through the network are sent in the clear, the same as an entirely open network.


How to prove identity of my users from the public JSON files? In the system that I am building, users create their own public JSON files on the Internet, available to anyone. My system does not store these JSON files nor have anything except read only access to those files.

When my software grabs one of these JSON files and examines it, I need to know which of my users that file belongs to.

I have a vague idea of a solution but I'd like some feedback:

I will require the user to include a field in the JSON containing some bit of signed information, perhaps their userid. My software provides the user with this string of information to include in their JSON.

In my software, the user must specify the URL that the JSON can be found at. This allows me to ignore any JSON files where the user has not also specified the URL.

Thoughts?  Does this make sense?  Any issues? thanks!

No, I am afraid it does not make sense. If you sign only parts of it, anybody can copy that sign Part  in his JSON.

It would be better to sign the whole JSON, by calculating a hash of it and then sign that. That way nobody can alter it without having to sign it again.


Understanding the scope of Intel hyperthreading errata KBL095 Recently, many motherboards supporting skylake or kabylake, got a uefi update described as cpu microcode security update for a specific Intel errata, described by Intel as :

Short Loops Which Use AH/BH/CH/DH Registers May Cause Unpredictable System Behavior.
Under complex micro-architectural conditions, short loops of less than 64 instructions that use AH, BH, CH or DH registers as well as their corresponding wider register (e.g. RAX, EAX or AX for AH) may cause unpredictable system behavior. This can only happen when both logical processors on the same physical processor are active.

Intel issues cpu frequent errata that can cause denial of service, but in this case, manufacturer didn't create a specific uefi update for each of them.
Of course, I tried the following code on several logical cores which doesn´t crash anything (I don’t understand if all 8 registers must be involved to trigger the bug or only one of them is enough) :
48 ba ff 00 00 00 04    movabs $0x4000000ff,%rdx
00 00 00
.L5:
48 89 d0                movq    %rdx,%rax
48 2d fe 00 00 00       subq    $0xfe,%rax
08 f4                   orb     %dh,%ah
48 89 c3                movq    %rax,%rbx
48 81 eb fe 00 00 00    subq    $0xfe,%rbx
08 e7                   orb     %ah,%bh
48 89 d9                movq    %rbx,%rcx
48 81 e9 fe 00 00 00    subb    $0xfe,%rcx
08 fd                   orb     %bh,%ch
48 89 ca                movq    %rcx,%rdx
48 81 ea fe 00 00 00    subq    $0xfe,%rdx
08 ee                   orb     %ch,%dh
48 85 cb                test   %rcx,%rbx
75 cc                   jne    .L5
movq    %rcx, %rdx
movq    %rbx, %rax
movq    %rax, %rsi
leaq    .LC0(%rip), %rdi
movl    $0, %eax
call    printf@PLT

So does unpredictable system behavior imply remote code execution (e.g. because such loops would propagate register change to the other thread running on the same core) ?
Also, what kind of loops can trigger the bug? Does simply modifying some of the involved registers in less than 64 instructions trigger the bug? Does loops needs to be different (I mean threads shouldn’t use the same code)?
At least can it be possible to have example Ocaml code that can trigger the bug?
How to know if a vulnerable microcode is used while running qemu-kvm? (qemu -cpu host hides microcode revision number)

The ocaml bug tracker still has the original bug report: https://caml.inria.fr/mantis/view.php?id=7452

Using the same ocaml version (4.03) and using the steps to reproduce, namely: while ocamlfind opt -c -g -bin-annot -ccopt -g -ccopt -O2 -ccopt -Wextra -ccopt '-Wstrict-overflow=5' -thread -w +a-4-40..42-44-45-48-58 -w -27-32 -package extprot test.ml -o test.cmx; do echo "ok"; done it is stated that it can be reproduced within ~30m on an unpatched machine.

I could not find any internal Intel information concerning the errata. I assume it is kept secret due to the sensitive nature of the issue.

The debian ML post (https://lists.debian.org/debian-devel/2017/06/msg00308.html) has more detail on the issue itself and the types of processors affected. This might be relevant to your research.


Breaking mysql username and password form I have two versions of a website. The first one has no security precautions against sql injections. So if I try something like:

Username: hello_world
Password: ' or ' 1=1

I'll be signed in as the user hello_world.

The second version of the website escapes single quotes to two single quotes. So the first attack I used on the first version doesn't work. When I get a successful login on the first version, I get a response that says:

username = hello_world & password = %27%20or%20%27%201%3D1

So all of the special characters are being replaced by their hex value. When I try something like this:

Username = hello_world
Password = %27%20or%20%27%201%3D1

In the second version of the site, it doesn't work (because the % is being changed to its hex value).

Is there a way I can log in as the user hello_world?

NOTE: I do, in fact, have permission to perform tests on this site.

The second version of the website escapes single quotes to two single quotes.
Is there a way I can log in as the user hello_world?

Yes, because this kind of protection is not secure at all (I also would not call it escaping).
Attack
Imagine an attack like this:
Username: hello_world
Password: \' OR 1=1 #

Which would be transformed to:
Password: \'' OR 1=1 #

Which would probably look like this in a query:
SELECT * FROM users WHERE username='hello_world' AND password='\'' OR 1=1 #'

Which is then executed like this, because the comment (#) cuts of the rest of the query:
SELECT * FROM users WHERE username='hello_world' AND password='\'' OR 1=1

So it checks if your password is \' or if 1=1 (which it does) to authenticate the user hello_world.
Further Damage
Note also that login bypass isn't the only attack that can be done here.
Data can also be retrieved via blind SQL injection (true = logged in, false = not logged in):
SELECT * FROM users WHERE username='hello_world' AND password='\'' OR ascii(substring((SELECT password FROM mysql.user LIMIT 0,1),1,1))<100
[ etc. ]

It is a noisy attack on a login page, but still, it could cause serious damage.
Prevention
Filtering is the worst kind of protection against SQL injections. Escaping (eg via mysqli_real_escape_string) is better, and using prepared statements is best (they are harder to mess up than escaping).


Is this GET request an exploit attempt? I've noticed a few requests like this to a Rails application I am maintaining:

GET http://mydomain.com/?f=4&t=252751+++++++++++++++++++++++++++++++++++++++++Result:+%E8%F1%EF%EE%EB%FC%E7%F3%E5%EC+%EF%F0%EE%EA%F1%E8+85.17.122.209:6188;+%ED%E5+%ED%E0%F8%EB%EE%F1%FC+%F4%EE%F0%EC%FB+%E4%EB%FF+%EE%F2%EF%F0%E0%E2%EA%E8;+Result:+GET-%F2%E0%E9%EC%E0%F3%F2%EE%E2+1;+%ED%E5+%ED%E0%F8%EB%EE%F1%FC+%F4%EE%F0%EC%FB+%E4%EB%FF+%EE%F2%EF%F0%E0%E2%EA%E8;

It looks like an attempt to exploit some vulnerability to me, but I can't make sense out of what it's supposed to do, and it's kind of hard to google. Any insights would be appreciated.

The request parameter is encoded with Windows Codepage 1251 and contains an apparently harmless error message in Russian:

  используем прокси 85.17.122.209:6188; не нашлось формы для отправки; Result: GET-таймаутов 1; не нашлось формы для отправки;

Roughly translated to English, the message reads:

  using proxy 85.17.122.209:6188; there were no forms to be sent; Result: GET-timeout 1; there were no forms to be sent;

It surely does not look as if someone is trying to hack you. I would rather assume that something is trying to report an error and due to misconfiguration is calling your server instead of whatever is supposed to track or handle the problem.


What kind of encryption is generally used for api keys? I was playing around with Go's rsa library, attempting to generate key pairs for a paid api service. That was when I noticed that rsa key pairs come back really long and with multiple components (modulus, exponent, primes).

I'm wondering how companies like Amazon generate a key and secret that are 20 and 40 characters respectively? Are they using a hashing algorithm on the base64(key components), or are they using a different method to come up with these api keys?

I'm wondering how companies like Amazon generate a key and secret that are 20 and 40 characters respectively?

Random string generation. They just need to be sufficiently difficult to guess, nothing more complicated than that.


SSD encryption vulnerability & TPM I've recently read several articles about this paper:
Self-encrypting deception: weaknesses in the
encryption of solid state drives (SSDs) by Carlo Meijer and Bernard van Gastel.

The thing I haven't been able to confirm is whether or not machines using a Trusted Platform Module (TPM) are affected by these vulnerabilities. From my understanding, the TPM generates and stores (part of) the key used by the hard-drive to encrypt itself (the "Disk Encryption Key", DEK).

However, the vulnerabilities allow attackers to decrypt the data without access to the DEK. To me, this means that the TPM does not protect against the vulnerabilities.

Can anyone confirm this or offer a better explanation?

Articles on the paper:

https://www.bleepingcomputer.com/news/security/flaws-in-popular-ssd-drives-bypass-hardware-disk-encryption/

https://borncity.com/win/2018/11/06/ssd-vulnerability-breaks-bitlocker-encryption/

https://www.theregister.co.uk/2018/11/05/busted_ssd_encryption/

TPM just stores the AK (authentication key) that is used to decrypt the DEK (Data encryption key) internally in drive. Then DEK is used to decrypt data.
From Overview of Encrypted Hard Drives and BitLocker (eDrive) that is actually implementation of TGC OPAL2:

Strong security based in hardware: Encryption is always "on" and the keys for encryption never leave the hard drive. User authentication is performed by the drive before it will unlock, independently of the operating system.

Another good source of information is at:
https://wiki.archlinux.org/index.php/Self-Encrypting_Drives#Set_up_the_drive
About vulnerabilities
I own Samsung 850 EVO SSD and I really wanted to find the answer how bad it is, So I have been searching information about the flaws all day. Everyone claims the Samsung's SSD is not safe. So I have read the original whitepaper:
Self-encrypting deception: weaknesses in the encryption of solid state drives (SSDs)
There is particular table about security flaws:

Vulnerabilities are related only to ATA Security and impact 'Depends' for Samsung's ones.
ATA Security:

...
The ATA password may be cryptographically bound to the DEK. This depends on the value of the MASTER PASSWORD CAPABILITY bit during the ATA security setup.
...
In case the MASTER PASSWORD CAPABILITY bit is set to Maximum, the decryption key is derived from slot 502. Otherwise, the key is stored in plain-text format in slot 465, and slot 502 and 503 are used for password validation only. Thus, allowing the encryption to be bypassed.
...

But in attack strategy they mentioned for OPAL (Bitlocker + HW Encrypted Drive):

(850) Since TCG Opal implementation is mostly identical to its predecessor, no weaknesses have been identified.
(840) If ATA security, with the MASTER PASSWORD CAPABILITY bit set to Maximum, or TCG Opal is used, then the DEK is cryptographically bound to the password.

That means it can't be bypassed without the AK (in your case stored in TPM).
I am a bit surprised that even Samsung recommended use of 3rd party software encryption as mitigation for the vulnerabilities even their disks should be fine if they are not using ATA Security.
What I wasn't able to find is information if you can use ATA Security operations if disk is in OPAL 2 (Encrypted drive for Bitlocker) mode.
I think it can't be used because the mode is chosen once during setup of a drive and it is not easy to reset it - actually reset the DEK for which the PSID label is needed... But I am not sure.


How to tell if Microsoft office has been patched for a vulnerability? The NIST database holds records for Microsoft Office vulnerabilities, however it only lists the application (i.e. Word 2016) and the service pack. Microsoft release hotfixes outside of service packs, therefore the NIST data alone isn't enough to tell if an installation of Office is vulnerable or not.

For example CVE-2019-1201:

https://nvd.nist.gov/vuln/detail/CVE-2019-1201

which can be patched in Word 2016 with the 4475540 update.

The Word executable has a build number, such as 16.0.4229.1024, is there any way to use this build number to identify what vulnerabilities exist or have already been patched?

For example, I'd like to replicate the behaviour NIST has for Adobe, where all versions up to a build number are specified, such as CVE-2018-4890

https://nvd.nist.gov/vuln/detail/CVE-2018-4890

  Up to (including)
  17.011.30070

Microsoft provides extensive release notes for all of their products. They clearly label patches that fix a security defect.

https://docs.microsoft.com/en-us/officeupdates/


How to choose between password derivation or encryption? Suppose you use a password manager having all possible features of modern password managers: encryption with a key derived from your master password, auto-filling, cloud or local storage, browser extension, web and local applications, random password generator, password auto-change, etc.

Now, suppose that you have the choice between these two options:

storing a randomly generated strong password directly in the encrypted vault (KeePass-like, with the ability to choose how long the vault can stay unencrypted, or when to ask again the master password: before each use, etc.)
storing only the pattern used to derive a strong password from your master password (LessPass-like, with the ability to choose when the password is derived: just after the decryption, before each use, etc.)

Finally, suppose that the round numbers used by the derivation functions (for the encryption key and the strong password) are high enough for the derivation to take roughly one second on most devices.

How to choose between those two?
What are their pros and cons?
Which one is the most secure in which case (concerning both cryptography and usability)?
Are there other parameters to take into account to make this choice (features, closed or open source, etc)?

I have used deterministic password managers (pwdhash, what you call password derivation) for a long time and I wouldn't advice anyone to use a deterministic password manager. I also wrote a blog post about this, but I'll summarize my main issues here:

It is hard to determine the account to derive the password for. Maybe you want to use the same password for wikipedia.org and for wiktionary.org, or live.com and microsoft.com. Determining the account to use based on the domain name is pretty hard.
It is hard to conform to password requirements. Some sites don't allow passwords of 20 characters, and some sites require your password to be 20 characters. How is your derivation function going to handle that?
It is hard to change the derivation function. Once you use the derivation function, you depend on it for all your passwords. You can't increase the complexity or increase the length of the derived passwords or anything, because then you can't login anymore on all sites.
If you use some site to derive the password, such as lesspass.com or pwdhash.com, you supply that site your master password every time and that site generates your account password. This creates an enormous single point of failure. If that site is compromised all your accounts are compromised.

The main "advantage" is that a deterministic password manager doesn't keep state. However, it becomes increasingly easy to store state somewhere on the internet, either in a file in Dropbox or through some cloud service.


How can non-secure or non-HTTP-only cookie affect security of an HSTS website? If a website is running on HSTS and it is setting about 20 cookies. Out of those 20 cookies 15 are both secure and HTTP-only and remaining 5 are neither. In this scenario, in what ways can we compromise the security of the website?

The non HTTP Only cookies could be compromised if there are any XSS flaws on the website.

The non secure flagged cookies could be compromised if the user was using a browser that does not support HSTS (such as Internet Explorer 10). This would be a MITM attack on a normal HTTP connection to any server in order to redirect to the HTTP version of the domain and then intercept the sent cookies.

The Secure and HTTP Only cookies could be poisoned if the user hasn't yet visited the site in order for the HSTS policy to be set and the site isn't in the browser's preloaded list. This depends on what the site does with the cookie values, but it could form part of a session fixation attack if an attacker set the cookie value. This would be without the Secure flag being set (because they would be MITMing a HTTP connection), however the server only receives the cookie's name and value and does not know whether the cookie is marked as secure or not on the browser.


Is it possible to fake incoming IP? I would like to whitelist an IP address on my smtp server so that non-authenticated emails on connections originating from that IP could be routed. I control that other IP, so I can make sure that only the emails I want to originate from it will originate from it and nothing else.

If I do that, can some one leverage this setting, fake the incoming IP address and use my smtp server as an open relay?

There is "open internet" between the two servers.

IP spoofing is the term used for forging an IP address, however it's very hard to accomplish with a SMTP connection as it requires an established TCP connection. IP address spoofing works as an attack when you don't need traffic coming back to the sending host. Using an analogy, if I send a letter to an address with a return address other than mine I will not get any response - it will be sent to the return address on the letter. I would not be able to form a correspondence with anyone if I'm forging the return address.

SMTP uses TCP, a protocol that establishes a connection between two hosts and controls the flow of information between them. A system trying to establish a connection using a spoofed IP address will not be able to set up a TCP connection as packets from other host will be routed to a the server which actually owns the IP address.

If someone was able to insert themselves in a point in the network between the two authentic servers they could use Network Address Translation to change the source IP address of packets from a server they control and set up a TCP connection, however this is very sophisticated and extremely unlikely. In any case you could defeat this by using public/private key pairs to verify the sending host. You don't need to be concerned about someone spoofing the IP address of your email server.


How do Malware Analysts detect spoofed information? Although I am fairly new to the industry (3rd internship at a financial institution), I am sure most people have heard and understand the concept of spoofing information, like a sender IP, or MAC address.

My question is, how could an Analyst detect if certain information is spoofed? How could they detect that an IP is not actually the IP of the sender?

My best guess from what I have learned so far would be to look at the logs and compare the potentially spoofed information to the actual route the packets took on the network.

Well we know that spoofing an IP address (over TCP) is highly improbable due to the three-way handshake that takes place.

On the other hand, spoofing a MAC address is a fairly trivial task. Your only detection for spoofed MACs is to look at the MAC and try to determine the manufacturer (the first three values (i.e. the three "XX"s) denotes the manufacturer in an address like XX:XX:XX:12:34:56). Note that only bad MAC addresses, in other words, MACs that don't resolve to a manufacturer, would be clear indications of spoofing. If the actor spoofs a valid MAC, this will be harder to detect.

Typical controls to mitigate spoofing include using SSL (over TLS) with a certificate signed by a Certificate Authority (CA).


How would a keylogger bypass Wireshark sniffing? I often see malicious keyloggers being advertised as having anit-wireshark feature. Meaning their data can't be sniffed. Is it possible to do so? How would they do it?

My guess is that they just check if Wireshark is running and don't send logs if Wireshark is running. So, this wouldn't work if you are capturing packets using a router or another computer. Am I right?

If an attacker roots a system they can install drivers which will hide malicious traffic from sniffers like wireshark, tools like netstat, or process utilities like task manager or PS. An attacker could have keyloggers, spam bots, ddos tools, anything they like running on a system and even administrators would be completely oblivious unless they ran an external sniffer.


Recover a bitlocker encrypted hard drive I have a laptop that died and the hard drive is encrypted with bitlocker. My company does not want to restore the drive.

If I remove the drive and put it into a housing and try to read it from another company laptop that also uses bitlocker encryption, will the new laptop be able to read the drive?

The bitlocker key is stored on the physical computer TPM (Possibly password protected, if you're in user authentication mode). So without the computer, you will have to manually provide the key (48-digit recovery password).

This recovery key should be available to the Active Directory Administrator (See tech support page) if they chose to do so, which for business continuity I hope they did.

While you have the recovery key, you can access the disk from any computer on which you can plug it on.


Using "canaries" to detect intrusion? I haven't read much about such a technique, but I'm wondering if there's any sort of best practice around the use of "canaries" to detect certain types of intrusion:

Create a bogus account that should never be logged in -- if someone attempts to access that account, report an intrusion attempt.
"Seed" the database with email addresses or other info that can be monitored. If you start getting email (or snail mail, phone calls, etc) at the monitored info, ring the bell, you're screwed: someone stole your database. (This was how I found out about the Ameritrade data leak from a few years ago -- before they publicly disclosed the leak.)

Clearly things like monitoring 404s for scans will be very noisy. (One of my very low traffic sees tons of requests for phpMyAdmin and wp-content...) And it's obvious that the second bullet above is too late to be worth much. The first bullet might even be too noisy.

A proper IDS is going to do a more thorough job. Is any of this useful? Are there things I'm missing?

This is the same as a High Interaction Honeypot idea, but you seem to be asking about embedding honeypot elements in production systems. Even so, I believe that the best practices for honeypots would apply here.

As for your second bullet point, a Data Loss Protection system would seem to be a better way to go. You can monitor, track, and most importantly, prevent data from travelling to areas that it should not.

I use 'bogus accounts' all over my systems, implemented in various ways as a honey-trap. I personally do not believe they hold much value for me, but they are cheap to have, test, and monitor.


How to detect port scan on SIEM within LAN or same Network? Let's suppose a host machine in the client environment has been infected and its performing port scanning on other machine within the LAN or same Network without passing through Firewall:

On what basis we can write an Alert in SIEM Tool to catch this port scanning.
Window machine logged these kind of activity or not. If yes where I can find the logs?

Basically if the event is happening across firewall we can write an Alert based on firewall,but If this activity is happening within the LAN then how to detect it?

When the infected machine tries to send the details to attacker how can we get hold of it?

As communication can occur through mail by WORM or through high level port which the client might be using for some other service.

Every connection within your LAN must go through a router or switch. Some routers allow access control lists, which can block/allow connections to specific ports and services. Each host may also implement internal firewall rules to only broadcast a service to specific hosts, this however, means more management and operational overhead. Another option is to have a NIDS monitor for these sort of things. (Here is how to do it in snort)

Remember that a port scan is not the only way to find out which services does the infected machine access, by just listening to the open connections for a period of time, the virus/trojan/malware can gather which machines within your network are accessed and on which ports, not a 100% sure approach but helpful nonetheless.


Demonstrate SQL injection using QR code I found a way of inserting an SQL injection through a non-secure query. The program is a checkpoint control that works with QR codes. It checks if your code exists in a database and if it does you are welcome to enter the facility.

Now... as that is the only input from non-staff people, measures against SQL injections are not being taken in the code. Now if I take an "infected" QR code to input to the system I am sure it will make them believe the threat... how would you exploit this? (SQLite)

"SELECT count(*) FROM validation WHERE qrstring='" + qrcodestring + "'"

I found a couple but nothing major like getting valid codes from other users or something like that...

Also, is my fear logical, or is this safe? Because, I was made fun at for exposing this.

I've found out the answer I was looking for, although there is no way (that i know of) of displaying other codes because I don't present the database information in anyway. still it is possible to bypass the security verification by using a simple ' or ''='. My solution for this was adding complexity layers to the type of codes my program accepts, for example, I am using a GUID and I know it has 36 chars on length 3 hashes (-)... and a code that does not present this characteristics is not allowed to interact with the database at all.

Check this awesome answers for more on-topic information.


Where do Common Criteria threats, policies, assumptions and objectives come from? When reading something dealing with Common Criteria for Information Technology Security Evaluation it is clear where ABC_DEF-type acronyms come from - they are thoroughly described in parts 2 and 3.

But where do Threats, Policy, Assumption (T.[SOMETHING], P.[SOMETHING], A.[SOMETHING_ELSE] and O.[SOMETHING]-type stuff) and their details come from? Is there a comprehensive list or do people just write anything they want in there?

According to the specification, these have no predefined list. These are defined as required for the situation.

A.6.2 Threats
291 This section of the security problem definition
shows the threats that are to be countered by the TOE, its operational
environment, or a combination of the two.
292 A threat consists of a
threat agent, an asset and an adverse action of that threat agent on
that asset.
293 Threat agents are entities that can adversely act on
assets. Examples of threat agents are hackers, users, computer
processes, TOE development personnel, and accidents. Threat agents may
be further described by aspects such as expertise, resources,
opportunity and motivation.
294 Threat agents may be described as
individual entities, but in some cases it may be better to describe
them as types of entities, groups of entities etc.
295 Examples of
assets can be found in Section 7.1.
296 Adverse actions are actions
performed by a threat agent on an asset. These actions influence one
or more properties of an asset from which that asset derives its
value.
297 Examples of threats are:
− a hacker (with substantial
expertise, standard equipment, and being paid to do so) remotely
copying confidential files from a company network;
− a worm seriously degrading the performance of a wide-area network;
− a system administrator violating user privacy;
− Someone on the Internet listening in on confidential electronic communication.


How to prevent a docker container from being attached by multiple users? When you run docker containers you can list running containers by using docker ps

Then you can attach them by docker attach <container id>

The trouble is that all people that can attach the running container at the same time as you, and will see what you are doing at the same time, that could be cool for online courses, but not very nice at works.

How can I prevent that?

If a user on a Docker Engine host has rights to execute docker commands (via either having sudo privileges, or membership of the docker group) there is no way (with the base Docker product) of restricting them from attaching to containers running on the host

Effectively providing docker access is the same as providing root on the host.

So to prevent it, the key is don't let other users have rights to run docker commands on that host.


PCI MFA (Multi-Factor Authentication) Following this link: https://www.pcisecuritystandards.org/pdfs/Multi-Factor-Authentication-Guidance-v1.pdf

All I understand is that:

The intent of multi-factor authentication (MFA) is to provide a higher degree of assurance of the identity of the individual.
The overall authentication process for MFA requires at least two of the three authentication methods described in PCI DSS Requirement 8.2

How does a Company achieve compliance PCI MFA and especially who checks this compliance?

How does a company achieve compliant PCI MFA?

All access from out-of-scope environments to the in-scope environment needs to use MFA. Typically, businesses deploy a jump (bastion) host in a VLAN which is accessible from the out-of-scope environment. MFA is implemented to access the jump host. Once the end user has authenticated using MFA to the jump host, they can have direct access to other in-scope systems using username/password only. Alternatively, one could implement MFA on access to any in-scope system but this is not as simple.

Who checks this compliance?

Depending on the volume of transactions your business handles and your merchant or service provider level, the validation can be through self-assessment or through on-site technical validation by a QSA. Your acquirer should indicate if you can self-assess or need an assessment by a QSA.


Is it possible to have full LAN access through a meterpreter session? e.g. for a MITM attack Is it possible to perform a MITM Attack through a compromised Windows Machine in a internal LAN?
How would be the attacker's scenario? How to do this?

Of course.

From a meterpreter session you could run post modules that run on the compromised machine.

You could also use port forwarding in the case you want to connect to Remote Desktop and the port itself isn't accessible from the attacker's machine.

Tools like nighthawk can be used to achieve ARP spoofing (MITM).

It all depends on how stealthy you need to be. Note this is a brief overview and I haven't gone into any depth on these items as your question seems very broad. Feel free to ask a new question covering only a specific item, then link back to this as reference.


How to you manually decrypt a SOAP message using openssl? So I have a SOAP message like this (key data and encrypted data has been truncated):

<s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" xmlns:a="http://www.w3.org/2005/08/addressing" xmlns:u="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd">
  <s:Header>
    <o:Security xmlns:o="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" s:mustUnderstand="1">
      <e:EncryptedKey xmlns:e="http://www.w3.org/2001/04/xmlenc#" Id="_0">
        <e:EncryptionMethod Algorithm="http://www.w3.org/2001/04/xmlenc#rsa-1_5"/>
        <KeyInfo xmlns="http://www.w3.org/2000/09/xmldsig#">
          <o:SecurityTokenReference>
            <X509Data>
              <X509IssuerSerial>
                <X509IssuerName>CN=blah, O=blah, L=blah, S=blah, C=blah</X509IssuerName>
                <X509SerialNumber>1</X509SerialNumber>
              </X509IssuerSerial>
            </X509Data>
          </o:SecurityTokenReference>
        </KeyInfo>
        <e:CipherData>
          <e:CipherValue>TiMPCLfQgfw==</e:CipherValue>
        </e:CipherData>
        <e:ReferenceList>
          <e:DataReference URI="#_2"/>
        </e:ReferenceList>
      </e:EncryptedKey>
    </o:Security>
  </s:Header>
  <s:Body xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" u:Id="_1">
    <e:EncryptedData xmlns:e="http://www.w3.org/2001/04/xmlenc#" Id="_2" Type="http://www.w3.org/2001/04/xmlenc#Content">
      <e:EncryptionMethod Algorithm="http://www.w3.org/2001/04/xmlenc#aes256-cbc"/>
      <e:CipherData>
        <e:CipherValue>1qsIPulqkVQ3==</e:CipherValue>
      </e:CipherData>
    </e:EncryptedData>
  </s:Body>
</s:Envelope>

So the body has been encoded in aes-256-cbc and then the session key that did this encoding has been encoded with my public key.

My question is how do I decode this manually?

I was trying the following:

Copy Encrypted Session Key to a file

  echo "TiMPCLfQgfw==" > sessionkey.enc

Format key to 64 chars max per line:

  sed -e "s/.{64}/&\n/g" < sessionkey.enc > sessionkey.hex

Convert session key to binary format for openssl (as rsautl command only works with binary):

  openssl enc -in sessionkey.hex -out sessionkey.bin -d -a

Decrypt session key using openssl and privatekey:

  openssl rsautl -decrypt -in sessionkey.bin -out sessionkey.dec -inkey myprivatekey.key

Copy Encrypted Message Body to a file

  echo "1qsIPulqkVQ3==" > messagebody.enc

Format Encrypted Message Body to 64 chars max per line (hex format):

  sed -e "s/.{64}/&\n/g" < messagebody.enc > messagebody.hex

Convert Message Body key to binary format for openssl:

  openssl enc -in messagebody.hex -out messagebody.bin -d -a

Decrypt Message Body using openssl and session key:

  openssl enc -aes-256-cbc -d -in messagebody.bin -out messagebody.dec -kfile sessionkey.dec

But I get "bad magic number" on this last step when I try this. Any ideas why?

(It is not "hex", but Base64. Not a critical point here, but if you get the terminology right then it becomes easier to search for solutions on the Web.)

When doing symmetric encryption, openssl enc, the command-line tool, uses its own non-standard, OpenSSL-specific format which does not match what SOAP uses. OpenSSL adds a specific header (that's the "magic number" it is complaining about) and some randomness (a "salt" -- salts make a lot of sense when keys are passwords, but that's not the case here). According to the specification, encryption with AES-256-CBC in SOAP simply adds the IV as the first 16 bytes, and there is no header and no salt. This means that the following should work (I have not tried):

Extract the IV:

dd if=messagebody.bin of=iv.bin bs=16 count=1
Convert the IV to hexadecimal (real hexadecimal this time, not Base64):

ivhex=$(od -t x1 -w iv.bin | sed 's/^[0-9A-Fa-f]*//' | sed 's/ //g')
Extract the actual encrypted data:

dd if=messagebody.in of=edata.bin bs=16 skip=1
Apply decryption with explicit IV, and instructing OpenSSL not to play its own non-standard games with salts:

openssl enc -aes-256-cbc -iv $ivhex -kfile sessionkey.dec -nosalt -in edata.bin -out cdata.bin

The last remaining thorny issue is the padding. OpenSSL, apparently, uses PKCS#7 padding, which means n bytes are appended to the data upon encryption, so that:

n is between 1 and 16 (at least one, at most sixteen added bytes);
the total padded length is a multiple of 16;
the n added bytes all have value n.

SOAP, on the other hand, mandates something similar, except that they only require that the last added byte has value n; the n-1 other bytes can have any value. Thus, when OpenSSL will decrypt the data, it might find a padding which is not exactly what it would expect (it depends on whether OpenSSL insists or not on all padding bytes having value n, and on what padding byte values were used by whoever produced the encrypted data in the first place).

If padding seems to be an issue, try adding the -nopad option to the openssl enc command; then you will have to inspect the obtained binary data (e.g. with od), and remove the padding bytes yourself (again, with dd).

(All of the above has been written assuming a Unix-like system, e.g. Linux or FreeBSD.)


Web App Pentesting: When enumerating website directories and files, how to tell if HTTP 200 is a valid page, or a failure page? Suppose a web app is being tested where all the functionality is behind a login.

One of the tests to be run is to check whether any of the pages are available without log-in.

We try the actual url of the page we want to reach and see if it redirects us to the login page, or, if it shows us the content without log-in (bad).

To automate this process we have a list of (supposedly) all the valid urls and we run a script that tries each page and records what the response code was.

If response is 200 then we got access without login, however if response is 301, 403 etc. then we're good on that url.

The issue is that this web app is returning 200 codes even when redirecting to login page.

Is there another way to detect the redirect?

Web Applications and HTTP Status Codes

If it's returning 200 on both an unauthorized page (302 Redirects to 200 login page), and an authorized page (discovered authorized page), there are some things you can do:

You can look for what happens on a successful login. Make a fake account, log in. See what does not get included on the real page, and what doesn't. That how you'll find your unique string.

Keep in mind: if there is a WAF or something, it could just start redirecting all of your incoming requests to 3xx/4xx, whether it's for valid or invalid requests.

Parse the HTTP response for HTML code or a string that would not appear on the login page, OR a string that ONLY appears on the Login page.

For example, the string "Unauthorized," or "Please Log In" could appear. You would want to exclude responses with those strings.

Both can be done using Python, or any scripting/programming language you want to use, including bash. Bash will, however, be much slower.

Could you provide an example please?

Sure. See below.

1. Using Python

You will have to edit this. It's quick example code.

import pycurl
import urllib
import sys
from StringIO import StringIO

c = pycurl.Curl()
html = StringIO()
c.setopt(pycurl.WRITEFUNCTION, html.write)
c.setopt(c.VERBOSE, 0)

def send_req(url):
    field = urllib.urlencode(payload)
    c.setopt(c.URL, url)
    c.setopt(c.VERBOSE, 0)
    c.perform()
    if "successful non-login-page string to search for" in html.getvalue():
        html = StringIO() # Reset
        return True
    return False

with open("dir-or-file-list.txt") as f:
    for line in f:
        if send_req("http://haxlogin.page/" + line + ") == True:
            print "[!] Found a valid page: %s" % line

I don't have time to check if this Python works, it's just a general example on how you could make it work with Python, so you'll need to edit it.

2. Using Burp Suite Pro

With Burp Intruder, on the attack dialog, you can use a filter. Imagine 2xx returns "Unauthorized" as the unique code/string. You will want to exclude "Unauthorized" from the search like so:

Filter:

Filter by search term "Unauthorized", negative search
Filter by status code: 2xx [success]

3. Using OWASP Dirbuster

Options -> Advanced Options -> Scan Options -> Fail Case String -> Enter a string that appears only on the login page

302 Redirects

Keep in mind: many applications perform a 302 redirect after posting something successfully.

That doesn't necessarily mean a 302 redirect is bad, or that you didn't find anything. Use curl -L to follow the redirect and see where that gets you.

You will likely also want to check the contents of the redirected page so you don't miss anything.


How to crack a password given its hash and its salt using a more efficient method than brute force? I have been able to crack passwords, given their salts and their hashes, by using brute force.

In the first place, the length of passwords was 3 and the salt length 2:

e.g., hash: rrVo/xC.s5/hQ, salt: rr => password: thr (time: ~0m4.579s)

Now, for passwords of length 4 and salt length 2:

e.g., hash: ss1C5xfz6Nggg, salt: ss => password: four (time: ~7m19.531s)

As I have said, these passwords were obtained using a brute force algorithm. It is useful for short password lengths: as the numbers of characters for the password increase, the required time to break the password grows exponentially.

What I want to know is more efficient technique to reduce the search space.

Additional info:

Passwords are created using: A-Z, a-z, 0-9, and symbols: $, #, +, @, =, /, &
I have been using the openssl command to generate the hashes and compared them to the given hash

$ openssl passwd -crypt -salt rr thr

in a bash script.

Without any more information, you can not reduce the search space. Since you don't have any prior information about the password, you can't rule out any possible password from the search space.
If your hash function (which you don't specify) has some vulnerabilities, you may be able to learn something about the password before starting the brute force attempt (starts with 'a', contains 'b' and so on...). Thus reducing the search space.
Something else that may answer your need for faster password cracking is Rainbow Tables which are a precomputation you perform given the salt, to be able to find the password faster later. Rainbow Tables are used as a lookup table for a given hash.
Say we have hash('four','ss') = ss1C5xfz6Nggg, and we know the salt ss. We will perform the following precomputation:

The actual Rainbow Table must be sorted according to the hash values, to enable fast lookup. This way, when given the hash of the password, ss1C5xfz6Nggg, we only need to lookup the hash in the Rainbow Table and our password is stored right next to it. Thus making the cracking process much faster (At the cost of precomputation time, of course).
Edit: Sjeord's comment is correct, so I must point out that:

Rainbow tables, despite their recent popularity as a subject of blog posts, have not aged gracefully. CUDA/OpenCL implementations of password crackers can leverage the massive amount of parallelism available in GPUs, peaking at billions of candidate passwords a second. You can literally test all lowercase, alphabetic passwords which are ≤7 characters in less than 2 seconds. And you can now rent the hardware which makes this possible to the tune of less than $3/hour. For about $300/hour, you could crack around 500,000,000,000 candidate passwords a second.

Source


What does key signing mean? What exactly does the "key signing" mean?

So for example I have a private/public GPG key so that people could send me encrypted e-mail, because they know my public key. But: what does key signing mean in this example? E.g.: "a third person signs my public key (how?)."

And the most important: Where can other people see that my key is signed by others?

OK, as you say, you have a private/public pair key so I can send you encrypted e-mail, because I know your public key.

But how do I know your public key? Obviously, because you told me what it was, and if you told me over a secure channel - for example you wrote it on a piece of paper and handed it to me in private - then that's fine.

But if you emailed it to me over an insecure channel how can I know that Eve didn't intercept your email and replace your key with hers? Then Eve could read my encrypted email, because I'd have encrypted it with her key.

This is a real problem because if we've only got the Internet as our communications channel then by definition it's not secure to use for exchanging keys. It can't be, because we haven't exchanged keys yet.

One way round this is to involve a third party who we both trust. Let's call him Bob.

Bob has a lot of secure channels to people. He has one to me and so I know his public key. He has one to you, and Bob knows your public key.

What Bob can do is take your public key, and encrypt the message "Lance's public key is 18348273847473436" with his private key. He then gives that encrypted message to you. Bob has signed your key.

Now, if you want to send me your public key, you just send me the signed key over the insecure channel. I know it came from you, not Eve, because I can decrypt it with Bob's public key, and I trust Bob.

So, we've turned the problem of "Graham and Lance need a secure channel between them" into the problem of "Graham needs a secure channel to Bob" and "Lance needs a secure channel to Bob".

It doesn't sound like we've made things better, until you realise that now instead of worrying about arranging secure channels to D.W. and Lucas and Schroeder and Thomas and Rory and Graham and everyone else on the Internet, you just need to worry about getting a secure channel to Bob, once.


Preventing License protection circumvention in Java software A software (written in Java) by a vendor uses DSA signature to verify that the license information is correct.

It achieves this by embedding the public key in the same Java software.

Legit license information is generated, and then signed with the private key, and is saved to a file, which can be verified by the public key.

Along comes a hacker, who generates his own private/public key pair, and changes the embedded public key in the Java software to his own. He then generates a license file with his own private key.

How can this scenario be circumvented? That is, what measures can the vendor take in order to prevent the hacker from doing the above?

Thank you.

Not much, really.
When the attacker has access to the code, he can modify it to his heart's contents.
You can make it more difficult, by using code obfuscation for example. But you cannot render it impossible.

You could make the code connect to a server via the internet to verify it's integrity, but the attacker could re-engineer the code to call on his own server, too. (And it will hinder any legitimate users whose connections are down...).

So you have to prevent the attacker from having access to the code.
Assuming your user has a reliable internet connection, this could be done by offering your code as a service (SaaS).


Attack from different blacklisted IP which belongs to different GEO location Attack from different blacklisted IP which belongs to different GEO location although source MAC address is same. Why?

The source MAC that you see is always going to be the MAC address of your router that's sending the packet along the last hop.  MAC addresses aren't routed; they're only visible between the two devices handing the packet to each other.

Given a packet routed from A to D via routers B and C:

[A] --> [B] ---> [C] --> [D]

B will see A as the source MAC address.
C will see B as the source MAC address.
D will see C as the source MAC address.

Given the MAC address of 00:00:CA:00:00:03 that the OP has provided in the comments:

The first three bytes are the Vendor ("Organizationally Unique Identifier", or "OUI").  These can be looked up to determine who manufactured the ethernet card you're seeing:

Wireshark OUI Lookup Tool says: 00:00:CA ARRIS Group, Inc.

If you Google ARRIS Group their Wikipedia page is the third hit:

  Arris Group is an American telecommunications equipment manufacturing
  company that provides cable operators with high-speed data, video and
  telephony systems for homes and businesses....

  ...

  Two of the company's popular home telephony modems are the TM402P and
  the TM502G. The firm also produces the SBG6782-AC wireless cable
  modem-and-router (residential gateway) unit, among other
  telecommunications and data-transfer products.

In other words, they make cable modems, which are the routers that your Cable company uses to provide Internet to your Firewall.


Is it a mistake to use a password that has previously been used (by anyone ever)? A few months ago, kutschkem answered a question about HIBP with this:

Let's say every person on earth has used ~1000 passwords so far. That makes approximately 10 trillion passwords, which is ~243 if I am not mistaken. Choosing any existing password at random is thus about as good as a truly random 8-9 character case-sensitive character password. Not very good. See this answer.
That basically means that, in theory, not only should one not reuse a password, one should not reuse a password that has been used by anyone ever. Passwords that have been used before are basically one big dictionary attack waiting to happen.

I was reminded again by the discussion between Mike Ounsworth and Conor Mancone in the comments on this answer about blacklisting the top N passwords versus the entire HIBP database.
Is kutschkem's math right? Does this make the conclusion right?

The math may be right. One could refine and complicate it as much as desired, but it doesn't really add to the point. So I'll leave it be.

Also, in practice it is easier—and might be faster—to check for any random character password with a fixed length than to check unique passwords from a list. A password list with 243 passwords with an average password length of 8 characters would be about 64 TB in size, if my calculation is correct. This would have to be stored somewhere in close proximity to the processor to be read with the same speed as the processor calculates the hashes.

The conclusion however, is not right: The important question is not if a password has ever been used, but if the password has ever been included in a breach.

If the breached passwords were thereafter publicly disclosed, they are now available on the internet. The passwords are now not just any passwords that have been used, but a very small subset of them. And to make things worse, this subset is used in wordlists by a lot of people around the world to check if they have been reused. So the chance that someone checks a hash against this password is a lot higher than the chance of him or her checking a hash against an unknown password, even if it has been used somewhere.

So I would not use a password that is included in the HIBP database, simply for the reason that those passwords have a higher chance to be included in wordlists.


Wifi login redirect applications This may sound a bit naive questions as i am a beginner. But I do my best to put it into words.
You may have experience when sometimes you want to use the internet in a cafe for example (with your wifi device ofcourse), when you click on the desired network, you will be redirected to a log-in page to insert a username and password. Is this a specific app? what is this app (functionality) called? Is it commercial or is there any open-source projects that can be used?
Thank you.

There are any of a number of different ways to do this.  Many options, both open-source and proprietary will handle it.  I know DD-WRT is one example of an open source router firmware which provides this kind of functionality directly.  Behind the scenes, what is basically happening is that any connection that is made to the device gets routed to a special network where any request will resolve to an HTTP redirect to the login page.  Once login is done, the router tracks the MAC address of the device that is allowed access and redirects it to the network that is actually connected to the network or Internet.

A similar type of goal can be accomplished for private networks using WPA-Enterprise which would require an actual username and password to be configured in the wifi connection itself, though WPA Enterprise is not what you are directly talking about since it doesn't use an open wifi connection.  It is, however, more secure since it gives each user their own user specific encryption and thus multiple users can not eavesdrop on each other.


Is Intel SA00086 / CVE-2017-5712 remotely exploitable? In regards to the 2017-11-20 Intel MEI/AMT vulnerability can someone explain the specifics of this terminology: "allows attacker with remote Admin access to the system to execute arbitrary code"? Does this mean to exclude any kind of remote exploit such as using specially crafted network packets?

I've seen this CVE marked as a remote exploit on some websites, but looking at the explanation it actually seems like this requires local access (as root/Administrator) to exploit. I realize something like a Windows Domain Admin would fit the bill as "remote Admin" with local access but how does this apply to a Linux system where there is no root (Admin) access allowed remotely?

In the context of Linux, if one obtains root via a privilege escalation exploit, they may deploy a rootkit via AMT or make other system modifications that one won't be able to evidence/remove by trivial OS fixes.

The scenario is:

An attacker gains remote code execution within the context of your web server (e.g. www-data or a user Apache runs at, or pick your favorite web server). At this point you should be able to identify these events in your logs and figure out how did they access the system, and potentially recover/patch/remove backdoors.
Via a privilege escalation vulnerability, they gain root/UID=0 privilege. Still, logs may be available, and you may be able to patch/recover.
They exploit the AMT/IMT vulnerability and gain AMT execution. At this point you lose any regular visibility to as what have they done at AMT level, and they may use this access to install a backdoor or rootkit that may be really difficult to discover/detect or eradicate.

The temporal score for you may not be the same as a unauthenticated RCE, depending on the context of the system, so I'd say it is a medium criticality vulnerability.

Case #3 applies also to authenticated attackers that may want to gain persistent access or mask their activities in a way that would not be visible to you via a SIEM/remote syslog or other means.

I hope this helps clear the issue.


Is there some way to verify that what I think I encrypted is actually what was encrypted when I don't have the private key? (PGP) Let's say that Joe gives his PGP public key to Sue so that Sue can send Joe a secret message.
Sue opens her PGP/GPG program, types I'm in love with Joe! and encrypts the message with Joe's public key.
The result is a blob that only Joe can read, because only he has the private key to his public key.
When Joe receives the blob and decrypts it using his private key, the message reads: I hate you, Joe!!.
How is this possible? Well, Sue's computer has been compromised by a jealous third party, Ken. Ken secretly installed a mechanism which changes the messages just before the PGP/GPG program uses the public key to encrypt the message, so that the wrong message is encrypted instead of the intended one.
Is there any way that Sue could have verified that the blob she sent to Joe actually contained the message she thought she inputted, when she doesn't have the private key? I of course don't mean to decrypt the message, but some kind of "true/false" answer whether the blob corresponds to exactly a given text. Is that possible?
(She does the verification on a separate, non-compromised computer.)

Is there any way that Sue could have verified that the blob she sent
to Joe actually contained the message she thought she inputted, when
she doesn't have the private key? I of course don't mean to decrypt
the message, but some kind of "true/false" answer whether the blob
corresponds to exactly a given text. Is that possible?

No, this isn't possible.
The only way for Sue to perform that verification is for her to have also encrypted the message to her public key.  This is commonly known as 'encrypt to self'.  But that's just a different way for her to have the private key, so it doesn't match your criteria.


Decoding base64 encoded message with a key I am pentesting a database that where I found data which was base64 encoded. I tried the usual method of decoding base64, which didn't work.

Later, I found in database a field called base64_custom_key. How do I decrypt a base64 encoded message with a key?

Base-n systems have n different symbols in their alphabet. Base 2 is just ones and zeros, base 10 has 0 through 9. Base 64 has 64 unique characters, as defined in its RFC.

If you see a 64-character long base64_custom_key field, I would guess that's the alphabet you have to use. I'll do an example.

The normal alphabet is A-Z, a-z, 0-9, + and ,. If the base64_custom_key contains ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+, then you have to do nothing because that's the original. But because the original does not decode properly, I guess that's not it.

If base64_custom_key contains ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123459876+, (everything normal, except the 9876 part), you might have to replace 9 with 6, 8 with 7, 7 with 8 and 6 with 9, and then run the decoder. The base64 encoding of zzz is enp6, but with this custom key it would be enp9. To decode it, we need to replace the 9 with a 6 as described, and you can then decode that normally.

Does that make sense?

It might not work, I'm just guessing what this might mean and how you might need to use that custom field. It's certainly non-standard and not a secure system, if it was intended for encryption at all (though I can't imagine another purpose).


Security implications of granting non-root access to privileged ports (<1024) Lots of solutions to this problem e.g. here and here but in order to decide which is best I'd need to know more about the security implications of each solution (or at least in general).
My context: I'm looking into running a rootless Docker/Podman Nginx container (on an Ubuntu Server 20.04 LTS host). Podman gives the following solution with this error message Error: rootlessport cannot expose privileged port 80, you can add 'net.ipv4.ip_unprivileged_port_start=80' to /etc/sysctl.conf (currently 1024).

When you're using rootless Docker/Podman, the risks of allowing users to bind ports < 1024, generally depend on what else is happening on the system.
TBH the old restriction on low ports doesn't really apply that much any more, as loads of sensitive ports are over 1024 (e.g. Docker itself which will default to listening on 2375 or 2376).
There could be a risk where, for example, you had a sensitive service which you wanted to listen on a low port, and you were concerned that a user launched service would clash with it, or if you have multiple users who may want to bind a port on a host, and a malicious user could try to get access to it, before the "expected" user.
However where that's not the case, you're probably fine to allow this. Docker's recommended solution here is to allow this for all low ports, which is less fine grained than the podman recommendation you mention.


Why are common services using implicit SSL not considered obsolete in the way that SMTPS is? SMTPS (implicit SSL) has been deprecated/obsolete since SMTP+STARTTLS (explicit SSL) was defined in RFC2487. I'm not entirely clear on the reasoning behind that, but it was clearly considered a good idea at the time.

A parallel can be seen with IMAP and POP3, using port 143 for IMAP+STARTSSL vs port 993 for IMAPS, and port 110 for POP3+STARTTLS vs port 995 for POP3S.

Since these protocols differ in the same way as the SMTP encryption options, why are these implicit SSL options not deprecated in the same way?

That said, I don't see why explicit STARTTLS should be considered a better option anyway - surely it's better to start encryption as soon as possible, and STARTTLS doesn't do that, so surely implicitly encrypted services are preferable? It appears I'm not alone in this thinking, as there is an internet draft suggesting exactly this.

The only upside of explicit encryption I can see is that you can run cleartext services on the same port - but that doesn't seem like something we should encourage or continue to support if it can be avoided.

What is the rationale behind all this?

tl;dr:

Because neither implicit nor explicit TLS is technically that bad;
Because changing ways the Internet works takes time.

This is essentially not one, but two different questions, and I'll address them separately.
1. Why are common services using implicit SSL not considered obsolete?
As you may have already noticed, in recent years, large corporations such as Google or Facebook have put a lot of effort in securing HTTP communications, and largely succeeded at that. But one of the main drivers for that seem to be ISPs replacing Web ads with their own, which severily harms Google's and others' business models.

By the way, the implied consequences of this are huge, the very structure of the Internet is going to change a lot as the result. Geoff Huston from APNIC has summed it up in his excellent blog post and related presentations (slides, video), so I'd better just refer to that without explaining it further here.

There are, of course, other drivers as well, but a lot of them are still heavily bound to securing someone's business models (e.g. PCI SSC activities and so on).
What's most important here is though those achievements in HTTP area raise a bar pretty high, many other ways of communication, including e-mail, seem to lack that sort of commercial drivers HTTP luckily has, and this is probably one of the main reasons their security stays rather obsolete, compared to what we have currently in HTTP. As the result, in 2018, it's still necessary to support a great number of outdated mail access servers, user and transfer agents which are only able to communicate in cleartext.
Hopefully this will change, but I personally can currently offer no clear estimations for that.
Both implicit and explicit TLS approaches are better than cleartext, as securing communication either way is better than not securing it at all. Some MUAs and MTAs deployments out there only support either implicit or explicit TLS, and deprecating any of the concepts leaves those deployments without any countermeasures against MitM attacks. Deprecating protocols and methods that are used actively on the Internet — and are essentially better than nothing — in favor of nothing is a bad practice.
As you can see, deprecating SMTPS alone haven't done us any good: it's still there in the wild. This is an example that a widely used Internet protocol couldn't be just shut down at will. Right, sounds funny, but back in circa 1998 when it happened it might have been less clear than it is today.
Moreover, declaring one of the concepts outdated in favor of the other must be supported by the Internet community, and though most people agree there should be only one of two options left as preferred at the end of the day, it's not that easy to reach consensus on whether explicit TLS is better or not (more on that below). The Internet draft you're pointing to is a fundamental initiative towards bringing a piece of sanity in all this mess without bringing up a common standards dilemma:

Once it's finalized, a process of explicit TLS deprecation would start at some point in future, but it will take time.
2. Why explicit STARTTLS should be considered a better option?

A disclaimer: this is simply an outline of current approaches towards the Internet protocol design. I'm not taking sides here, the right places for objections against those approaches are IETF working group mailing lists and meetings.

Implicit TLS is great for protocols which are designed from scratch, with contemporary threat models in mind, and which lack the requirement to support cleartext communication. However, implicit TLS is somewhat a controversial approach with regard to securing old cleartext protocols. It seems to be working fine for HTTPS, but it required some effort, including allocation of a different port (443) for secure HTTP communications.
The downside of this approach is that for each remaining cleartext protocol, you'll need to allocate another TCP/UDP port, while the global TCP port space is severily limited. At some point, IETF working groups generally considered wasting ports this way a bad practice, and even port 465 (originally SMTPS) was later reallocated for a different purpose (this actually happened about 20 years ago, which as well sheds some light on how slowly the Internet adopts changes).
Again, as you can see in draft-ietf-uta-email-deep, this consideration might be withdrawn in the near future.  Note also that this draft originally dates back to year 2013 and is now only approaching the final state, which gives you an idea of how hard this choice is overall.
The general idea of opportunistic (or explicit) TLS is to somehow inform a client in advance (using a different communication channel, already verified before and thus trusted) that a particular remote server supports STARTTLS, so the client must only use STARTTLS for data transfer towards that server, thus preventing STRIPTLS attacks. Originally DNSSEC was supposed to provide this separate channel, however, its worldwide deployment has somehow stalled, and as the result, working groups are considering other ways (e.g. TOFU) to do that.
Note that the implicit approach itself is not downgrade-resistant as well, as a man in the middle is able to strip implicit TLS. Approaches like HSTS depend on TOFU themselves. A common argument is that a user can force their software client into secure communication by explicitly specifying a port number in client preferences, but a software client can also provide user with an ability to explicitly enforce STARTTLS on an old port, so from the user's perspective the difference between two approaches is subtle.


Setting up home lab with Snort and Vyatta - looking for resource recommendations or advice I'm looking to turn a new desktop (Ubuntu 12.10-64bit) I built into a virtual home lab for testing and experimenting with various security things. The first setup I would like to try running is the basic set-up shown in the Snort install guide. For reference, it has an internet facing router which connects to a switch. That switch connects to the internal network, but also has a mirrored port to a machine running Snort. That Snort machine is then connected to another machine running the Snort management system.

I'm using VirutalBox and can facilitate all of these machines as VMs, and I've also downloaded the community version Vyatta iso which I have running in another linux VM. I have yet to really use Vyatta, but in my proposed set-up I believe I would need to configure two Vyatta VMs, one to act as the router, the other to act as the switch with the mirrored port. I could then use two other VMs for the required Snort boxes, and any number of other VMs to represent the internal network. Please let me know if you see a problem with the afore mentioned proposition.

I have the Vyatta documentation, and one setup example they provide is to have a Vyatta instance behave as a default gateway (which seems close/equivilent to the router functionality I would need from one of my Vyatta VMs). I have yet to find anything about creating a virtual switch with a mirrored port, and setting it up to point to "all the right places".

I'm curious if anyone is able to provide any insight, guidance or experience in achieving this type of configuration. I'm completely open to using other tools as well (I started looking at Vyatta because I was aware of it).

Background note of minor interest: I'm a software developer, but am not super strong on the "ops" side of things, which is why I'm trying to experiment.

If you set the network type to your virtual machines to Internal Network with the same internal network name (an arbitrary string of your choosing, but the same for all machines), and then configure (in the Advanced settings) the promiscuous mode to Allow All, then the VM will be all hooked to a virtual hub which is like a switch which mirrors everything everywhere. See the screenshot below:

These settings can be applied on a started VM but will take effect only when the VM is next shut down and restarted.

With a virtual hub, every packet sent by any VM will be visible to all machines, which should be enough for what you want to achieve (if I understand your situation correctly).

For mor details, see the Virtual networking chapter of the VirtualBox manual.


What are the disadvantages of logging someone in on register? So presuming a username/password authentication system (not an SSO) if you register a new user, what's the disadvantage of logging them in before verifying their account by email?

Let's presume that by logging them in they won't have access to sensitive content, or the ability to do something like charge a credit card.

Most software I've encountered does. "click register" -> "fill form" -> "send email" -> "activate account" (sometimes allowing concurrent login) -> login.

what I'm trying to figure out is if there's a security hole from basically taking a login form (you gave me a username/password) "click register" -> (account is created and you're logged in); or "click register" -> "fill form" -> "confirm and log in".

Obviously there are user experience advantages/disadvantages, but I've been trying to figure out if there are security implications of doing this. The only only security implication I can think of are SPAM accounts which is where someone is creating users automatically.

I'm just trying to ensure that I'm not making some mistake like not using a nonce in a password reset link (unrelated). Like maybe there's something security related that I don't know that I don't know.

You are introducing a user enumeration flaw into your system.

That is, any attacker can find out if bob@example.com is a user on your system by completing the registration process.

This is useful to an attacker for two reasons:

As per the article linked above

  As an attacker if I can use your login or forgotten password page to narrow my list from 10000 targets to 1000 targets, I will.

In a phishing campaign, the attacker knows exactly who to send their emails to.

There is also a privacy issue, especially if your site is something sensitive like Ashley Madison.

If the above is a concern to you, you can mitigate by requiring the user to acknowledge the activation email first. See this answer.

If not, then as you are not allowing them to access sensitive content or actions, there is little extra risk. If you were, then you could simply have a flag in the database: EmailConfirmed = 1 or 0, which will let your system know whether they can trust that the email address is genuine.

Also, not verifying users can be an annoyance when an email address is mistyped or purposely entered that of another person, in that the account gets squatted and the real user cannot then register their own account.

The real user of the account can sometimes regain control by completing the password reset process, although their account will then be tainted by whatever the previous occupier has setup. Again, this depends on the system but if there are sensitive settings such as extra recovery email addresses or access keys, or other active sessions, then there should be a way for users to reset their account to a fresh state after any squatting incident.

The other thing that may make reset tricky is if two factor authentication is employed. Any password reset by the real email address owner would be hindered due to lack of the second factor being available. In this case, it would be much easier to validate email address at point of signup instead as things can get complicated otherwise.


Why is NAT referred to as "the poor man's firewall"? How exactly does NAT protect a network? How does it relate to a firewall?

NAT acts as a firewall with a "default deny" policy for unsolicited incoming packets, but no other rules.

Because the machines behind a NAT box are not directly addressable (usually because they have private IP addresses), machines out on the general Internet cannot send IP packets to them directly.  Instead, any packets will be sent to the address of the NAT box, and the NAT box looks at its records to see which outgoing packet an incoming packet is in reply to, to decide which internal address the packet should be forwarded to.  If the packet is not in reply to an outgoing packet, there's no matching record, and the NAT box discards the packet.


Is there an optimised yet safe way to transfer bulk data from DropBox to OneDrive? The brute force way to do this is to download all data from DropBox to a local PC and then re-upload to OneDrive, but I see there are "cloud based" solutions (i.e.
cloudfuze, uBackup), which I assume do this via faster back-end links. Are any of these services certified as safe? It seems extremely risky to me to trust a third-party to transfer all of my data, but it would be a much faster mechanism to transfer c20GB of data.

Are any of these services certified as safe?

The short answer is "No". The longer one is equally discouraging. Who would certify the services, and by what standards?

  ... which I assume do this via faster back-end links.

Did you find this written down anywhere? I highly doubt it, they'll just offer to move the data for you.

  It seems extremely risky to me to trust a third-party to transfer all of my data...

You are absolutely right. Please don't use third party services to move your data, especially since they will certainly require authorisation to read your files from one services and to write them into another.

  but it would be a much faster mechanism to transfer c20GB of data

You can't be sure of this, you'd need to measure.

Just sync your local DropBox then re-upload manually to OneDrive from a trusted workstation, if this is what you need doing.


Is obfuscation worth it There are many tools to obfuscate .NET applications.

The free ones do some basic obfuscation while commercial ones seem to
promise more.

My question is: Is it worth to use the commercial obfuscation tools? Do they provide some security? I know everything is crackable if someone wants it badly. But I am talking about some "average" attackers. So is it worth to invest money in commercial obfuscators?

If someone is interested what I want to protect: program logic and/or keys (I know keys should not be stored in app but I am limited in where I can store it anyway due to context)

Note: Some users are mentioning that sometimes obfuscator may introduce bugs in working program. This is clearly bad. If someone can cover his/her experience about this kind of behaviour would also be useful. Is this behaviour different w.r.t to commercial vs free obfuscators?

The problem with client sided Obfuscation/Protection is that the attacker will always win.
Your code runs on his PC so he can intercept and manipulate everything in the end.
In the specific case of .NET it might make sense to apply basic obfuscation to remove function names for example but free tools are perfectly fine for that.

To answer your question a bit more specific:
Most commercial obfuscators do the same things that free ones do as well.
I'd go for Confuser/ConfuserEx, both are open source and provide better protection than most commercial stuff.


Attack vectors in POSTing variables from one php script to the next? I have an application which is structured in the following way for its signup page. After this signup, the user is directly granted access into the system - there is no email verification (as intended).

I'm interested in learning if there are attack vectors or other insecurities in how this workflow is constructed.

ScriptA.php takes user input in a FORM
When it is submitted, it is POSTed to ScriptA-verify.php
This second script verifies the information POSTed to it
If there is a problem, it POSTs the information back to ScriptA.php (so that the information is retained for the user)
If there is no problem, it adds the data to the database, sets a SESSION['userid'] variable, etc and POSTs some hidden fields to landing.php
In landing.php, we check if SESSION['userid'] is set
If it is not, we throw the user to an error page
If it is, we proceed with the application

It's difficult to give you a detailed answer as a lot will depend on the actual code you use to implement this process.  The first and arguably most important thing to consider is input AND output validation on the data supplied by the user.  There are plenty of good resources out there about that, http://www.owasp.org/ springs immediately to mind as the "go to" for that.

In terms of your actual approach, I would suggest that rather than having ScriptA.php POST to ScriptA-verify.php you should POST to ScriptA.php and handle the verification in there.  By all means accomplish this by performing an "include" of ScriptA-verify.php but what this means is that you do not have the added complexity and consequently risk, of posting data back to ScriptA.php if ScriptA-verify.php returns a problem.  The original form data will be available to you from your sanitised variables derived from $_POST (do not use $_POST directly, see above wrt validation).

The $_SESSION superglobal is "pretty secure" but there's a decent post here which you can find out a bit more from: Altering a $_SESSION variable in PHP via XSS?.  There are others on Security StackExchange too.

I don't get a warm, fuzzy feeling that your check of $_SESSION['userid'] is going to be particularly bombproof though a lot of that will depend on knowing other specifics of the process you are developing.  For example, ability to session hijack if session is conducted over HTTP not HTTPS, PHP configuration settings on your server, etc.

Another question I would ask is what checks are in the other pages that this login will protect otherwise you are potentially vulnerable to such things as Insecure Direct Object Reference.  In short, don't assume that people will always come through landing.php to get to "secured-page1.php".  If there's nothing in secured-page1.php to ensure a valid session all your efforts are in vain.

I also don't see anything which is going to protect your users from CSRF attack. Again it depends what the application actually does but if the only check before loading a page is for a valid session then it would be trivial to force a user's browser to request specific pages such as password resets or such like.  Again, the OWASP site can help you here.

This is something of a quick taster, brain dump answer.  If you can give more specific details of the code behind your app and possibly your experience level it may be possible to give you more low level and thorough advice.


Diffie Hellman and exchange of public key for signature Let's assume an insecure channel.

Is it safe to exchange Alice & Bob public keys first then apply them to sign communications during the DH process? (then encrypt+sign all future communications)?

Should the process be rather: a DH process applied first, then the public key exchange with unsigned messages, then encrypt+sign all future communications? (where obviously at the next DH, there will be not need to exchange again the public keys.)

For that first use you're doing unauthenticated DH.

And this is only safe against passive eavesdroppers. It is NOT safe against an active Man-in-the-Middle (MITM).

So if you were MITM'd during that first exchange, then all bets are off. If that time-window of exploitation is small enough for your purposes, you may still want to use it.

(So what you're doing is known as Trust-On-First-Use (TOFU). The first key exchange is validated in some way or other, or not at all, and all subsequent communication then uses that key.)

More info on Wiki: https://en.wikipedia.org/wiki/Diffie%E2%80%93Hellman_key_exchange

Especially this:

  Although Diffie–Hellman key agreement itself is an anonymous
  (non-authenticated) key-agreement protocol, it provides the basis  for
  a variety of authenticated protocols [...]


Could technical controls prevent vehicle ramming attacks? We've just seen another attack where a vehicle was used as a weapon. My thoughts are with all those affected by the tragedy.

Many people are wondering how such attacks can be stopped. It's hard for intelligence to detect: a lone terrorist, no communications, no need to acquire weapons or suspicious chemicals. Sensitive facilities, such as airports and transport hubs already have bollards to prevent such attacks. But this doesn't help when ad-hoc crowds form, such as Bastille Day.

Could technical controls in vehicles prevent such attacks? A vaguely similar approach is used in high-quality colour printers to stop counterfeiting. Indeed, many cars have a number of sensors that can detect collisions, and some already take automatic action to avoid collisions.

It's not clear if these would stop a terrorist: perhaps they would stop a drunk driver mowing down a crowd, but a terrorist will try to disable the safety feature. And there are new safety risks if we prevent drivers overriding such systems: they may prevent a driver taking desperate action to avoid a tragedy.

To keep this question in line with Stack Exchange rules: answers must be evidence based, and focus on the question: Can technical controls prevent vehicle ramming attacks? This is not the place for open-ended discussion of vehicle safety or terrorism.

Bollards are the traditional approach.   Normally to prevent vehicles from attacking high-value targets such as banks, embassies, etc.

https://en.wikipedia.org/wiki/Vehicular_assault_as_a_terrorist_tactic

In this shot in Istanbul, they protect sidewalks.

https://en.wikipedia.org/wiki/Bollard#/media/File:20131207_Istanbul_054.jpg

They can be disguised as flower boxes, benches, street lights, garbage bins, etc, etc.   The important part is to make sure there are no gaps... and that they're not run-of-the-mill street furniture, but genuinely tough enough to stop a truck.

For the situation in France, it might have given people who ran off the street some immediate protection, and may have stopped the truck before it could do much more harm.

It might not be high tech, but low tech is a kind of tech.

Looking at Google streetview, the location had no protections at all: https://goo.gl/maps/KjuXwxHHnM62


Simple Windows 7 honeypot: is this safe? I want to share a "honeypot" folder on a Windows 7 machine connected to a router.  The only shared folder in the local workgroup connected to this router is the honeypot folder, which allows unrestricted access to anyone on the local network.  I want to then allow anybody in range to connect to the router via unsecured wireless.

How safe is this?  With basic Windows security auditing on the honeypot folder, how specific is the information that I can I get on anyone who accesses it with wireless?  I don't have any interest in a honeypot exposed to the internet at large via SSH, FTP, etc., and I'm only interested in attempts to access this shared folder via wireless.

Deliberately opening your computer for attack is not safe.
You presume the attacker is interested in your shared folder, much more likely with a connection to the machine they will choose other attack avenue.
A better solution is to install a honeypot on the pc.


What ciphers should I use in my web server after I configure my SSL certificate? There are many great questions that ask what is the best certificate to use for a website; but once the certificate is purchased, there is also the possibility to choose or edit the Cipher list.

Although each vendor may call this setting something slightly different, my understanding is that the Cipher List is used to negotiate encryption protocols between the client and the server.

  What are the basics of choosing a Cipher list for my website?   If
  the defaults need to be altered Where should "beginners" go to get
  reliable advice?
  Have any of the traditional recommendations changed as of September
  2011's BEAST or 2012's CRIME attack?
  Does anyone maintain a list of ciphers supported by OS/Vendor/and
  version?  Is it correct to say that something like this would be
  useful?
  Are some certificates incompatible or not preferred with certain ciphers?
  Where can I learn more?  Specifically, how can I get a cursory
  ability to compare Ciphers without having to retake some
  post-secondary math classes?

In SSL/TLS, the cipher suite selects a set of algorithms, for several tasks: key agreement, symmetric encryption, integrity check.

The certificate type impacts the choice of the key agreement. Two parameters must be taken into account: the key type and the key usage:

With a RSA key you can nominally use the "RSA" and "DHE_RSA" cipher suite. But if the server certificate has a Key Usage extension which does not include the "keyEncipherment" flag, then you are nominally limited to "DHE_RSA".
With a DSA key you can use only a "DHE_DSS" cipher suite.
With a Diffie-Hellman key, you can use only one of "DH_RSA" or "DH_DSS", depending on the issuing certificate authority key type.

Most SSL server certificates have a RSA key which is not restricted through a Key Usage extension, so you can use both "RSA" and "DHE_RSA" key types.

"DHE" stands for "Diffie-Hellman Ephemeral". This allows Perfect Forward Secrecy. PFS means that if an attacker steals the server private key (the one which is stored in a file, hence plausibly vulnerable to ulterior theft), he will still not be able to decrypt past recorded transactions. This is a desirable property, especially when you want your system to look good during an audit.

For the integrity check, you should not use MD5, and, if possible, avoid SHA-1 as well. None of the currently known weaknesses of MD5 and SHA-1 impacts the security of TLS (except possibly when used within a certificate, but that's chosen by the CA, not you). Nevertheless, using MD5 (or, to a lesser extent, SHA-1) is bad for public relations. MD5 is "broken". If you use MD5, you may have to justify yourself. Nobody would question the choice of SHA-256. The general consensus is that SHA-1 is "tolerable" for legacy reasons.

For symmetric encryption, you have the choice between (mostly) RC4, 3DES and AES (for the latter, the 256-bit version is overkill; AES-128 is already fine). The following points can be made:

RC4 and 3DES will be supported everywhere. The oldest clients may not support AES (e.g. Internet Explorer 6.0 does not appear to be able to negotiate AES-based cipher suites).
There are known weaknesses in RC4. None is fatal right away. Situation is somewhat similar to that of SHA-1: academically "broken", but not a problem right now. This still is a good reason not to use RC4 if it can be avoided.
3DES is a 64-bit block cipher. This implies some (academic) weaknesses when you encrypt more than a few gigabytes in a single session.
3DES can be heavy on your CPU. On a 2.7 GHz Intel i7, OpenSSL achieves 180 MB/s encryption speed with AES-128 (it could do much better if it used the AES-NI instructions) but only 25 MB/s with 3DES. 25 MB/s is still good (that's 2.5x what a 100 Mbits/s link can handle, and using a single core) but might not be negligible, depending on your situation.
The BEAST attack is an old academic weaknesses which has recently been demonstrated to be applicable in practice. It requires that the attacker spies on the link and runs hostile code on the client (and that code must communicate with the external spying system); the BEAST authors have managed to run it when the hostile internal code uses Java or Javascript. The generic solution is to switch to TLS 1.1 or 1.2, which are immune. Also, this concerns only block ciphers in CBC mode; RC4 is immune.
In a SSL/TLS handshake, the client announces his supported cipher suites (preferred suites come first), then the server chooses the suite which will be used. It is traditional that the server honours the client preferences -- i.e. chooses the first suite in the list sent by the client that the server can handle. But a server could enforce its own order of preferences.
DHE implies somewhat higher CPU consumption on the server (but it will not make a noticeable difference unless you establish several hundreds new SSL sessions per second).
There is no DHE cipher suite which uses RC4.

Summary: this leads me to the following preferred list of cipher suites. If the BEAST attack may apply to you (i.e. the client is a Web browser), use this:

If the session uses SSL-3.0 or TLS-1.0, try to use TLS_RSA_WITH_RC4_128_SHA.
If the client supports TLS 1.1+, or if it does not support TLS_RSA_WITH_RC4_128_SHA, or if you consider PFS to be more important to you than BEAST-like active attacks (e.g. you are most concerned about long-term confidentiality, not immediate breaches), then use TLS_DHE_RSA_WITH_AES_128_CBC_SHA256 (fallback to TLS_DHE_RSA_WITH_AES_128_CBC_SHA if the client does not support SHA-256).
If DHE cipher suites are not supported by the client, use the corresponding non-DHE suite.
Generic fallback is TLS_RSA_WITH_3DES_EDE_CBC_SHA which should work everywhere.

Note that the choices above assume that you can alter the suite selection depending on the negotiated protocol version, which may or may not be an available option for your particular SSL server.

If BEAST does not apply to you (the client will not run hostile code), then drop RC4 support altogether; concentrate on AES-128 and SHA-256; fallback on 3DES and SHA-1, respectively; use DHE if available.