Ethical brute force demo on a web login when knowing the password complexity requirements We are currently having accounts compromised at a substantially high rate. Some in the organization believe that our password complexity requirements is enough to thwart brute force attacks.

I wanted to test and demonstrate how certain password complexity requirements can actually reduce the password search space.

Has anyone done this before? What tools should I look into? I specifically would prefer to test it on our Exchange 2010 OWA web page since that is publicly accessible and not rate limited at the moment.

It depends on the complexity requirements you're implementing and the baseline you're coming from. If your existing passwords are baseball and passw0rd and 123456, then anything is an improvement.

But the easy way to test complexity is to check to see how many characters are used from each of a given class (e.g. uppercase, lowercase, numbers, symbols). It's easy to program but it's also a very poor estimation of password quality.

The javascript library zxcvbn was designed by  Dropbox to give a more realistic estimation of password quality based on factors that actually matter when cracking passwords. Have a look at their writeup here on their blog for the how and the way.

The basic gist is this:

Common passwords are really bad, and fail regardless of composition
Long passwords are better than short passwords
A wider character set increases the incremental advantage of each additional character in length
Known dictionary words are scored as components of a dictionary, not as the sum of their characters


Apache2 Logs, need help in identifying if it is an attack or not Are this an example of an attack that had happened to my server?

This happened few days before I checked the logs... I checked the logs to see if something was wrong since my server suddenly uses all of its resources ( CPU and Memory )...

Edit: I have a cron that ran every day that clears access_log which is an idiotic thing to do (removed it today).

It might be an attack as well as the preparation for an attack.
Most likely one tries to find out about installed wordpress plugins or (depending on your apache/nginx config) just tries various default names for files (calles website enumeration) to figure out what you are doing. This might lead to some attempt to actually breach the site or he may just collect data. This article shows what happens if you do this on govt sites ;). If it is an actual attempt the attacker probably collected a lot of exploits, set some dependencies (like './cmv.php must exist and return...') and tries to execute them. (You could tell from more detailed access-logs.)

Anyway. If your access logs were more precise you could distinguish those two options but chances are you don't need to. This happens to most of the public IPs that have port 80 or 443 exposed on a daily basis because there is a lot of automated scanning and exploitation going on. If your security basis is working well (such as updates, maybe ModSecurity and so on) it's nothing to really worry about.


Nmap scan performance I'm trying to find the most efficient way to find open ports on target then find banner of running services on them. As I have read and experienced before, syn stealth scan gives the best outcome. But I'm not sure how -sV finds open ports.

For grabbing version information, does the -sV option give the same performance with -sS or should I first scan the target with -sS after then I scan open ports with -sV?

Nmap does its scanning in phases, with each phase feeding into the next one. When you do nmap -sV example.com, Nmap performs 7 scan phases. The ones you are asking about are 4 and 5 below:

Target enumeration. Nmap resolves the name example.com to some IP address like 192.0.2.33.
Host discovery. Nmap sends some probes like ICMP Echo Request, TCP SYN to port 443, TCP ACK to port 80, etc. If any of them get a response, the host is "up" and scanning continues.
Reverse-DNS resolution. Nmap sends a DNS PTR query for the IP address to see if a name is associated with it.
Port scanning. You didn't request a particular port scan type, so the default is TCP SYN scan (-sS) if you have privileges, or TCP Connect scan (-sT) if not.
Version detection. This is the "banner grab" that you requested with -sV, though it is much more complex than that.
Script scanning. When you do -sV, some NSE scripts may run to do further version detection. This is the same as specifying --script version
Output. The results are printed after all scan phases are done.

So you can see that there is no difference in port scanning between -sS and -sV, but in fact the exact same port scan is done for both. Optimizing the scan can be done with the -T timing template options or any of the more fine-grained controls.

You can also speed up your scan by eliminating unused scan phases. Host discovery can be skipped with -Pn if you know the target is up. Reverse-DNS can be skipped with -n. Port scanning can be altered with -p or --top-ports to scan more (slower) or fewer (faster) ports. You can eliminate the NSE script scanning part of version detection by adding --script-args script-intensity=0


Metadata leakage from security camera upload times Picture the following: A server controlling security cameras has a script that takes stored footage, encrypts the files with GPG, and moves it into a cloud storage folder (Dropbox in this case).

If an adversary compromised that account, what information could he gain from looking at the time at which footage is uploaded?

Note that footage is only recorded when motion is detected, so there's not a constant stream of data.

Footage has to be uploaded very soon after its recorded to protect from theft, so time delays in the script may not help much.

A lot would depend on your environment and what is being protected by the security cameras. For example, if you have multiple cameras and different filenames for each camera, then potentially, you could track the movements of someone in your environment. This could compromise other aspects of your security - for example, tell someone where the security patrol is or what path/pattern they follow and frequency of patrols etc. It may also be possible to perform some analysis of the file sizes to derive some other information as well - for example, perhaps number of people etc. One of the limitations of this type of metadata analysis is that you typically require quite large data sets in order to find meaningful metadata information. This often means considerable effort over an extended period of time. It also needs additional information about the environment i.e. number of cameras, site layout, file formats etc. Humans are also very creative and the right individual with the right mindset may find ways of deriving information which nobody else was able to conceive. This is why it is usually wise to limit the amount of information, meta or otherwise, attackers can access. The challenge is getting the balance right - at what point is the amount of effort used to hide this information more effort than the risk it is protecting against.

Then of course, there is the danger of actually cracking your gpg - while gpg is pretty good, it is also possible to either misconfigure it to use poor ciphers or too small a key etc. Sometimes, with applications like this, which may potentially need to encrypt large data sets frequently, options which increase encryption speed/efficiency are selected. In general, speed/efficiency and security are at opposite ends and if you don't get the balance right, you can compromise the security of the encrypted files. don't assume just because you are using gpg that your data is safe - it depends on what configuraiton options you are using.

Personally, I'd be more worried about the server compromise than the metadata such a compromise is able to reveal. Unless you are simply assessing the potential impact from a compromise, you need to consider what can be done to prevent the initial compromise first and then assess what measure would be approrpiate to mitigate the impact shold the compromise occur.

Having said all of this, I think it also needs to be highlighted that when it comes to physical security, more often than not, the real weakness is something far more simple. The effort and amount of information that can be gained indirectly via metadata usually takes considerable effort. You often require large amounts of input data to find useful patterns and it is generally a lot of work. This effort will only be worthwhile when the value of whatever is being protected is fairly high and even when it is, you will likely get a faster and less resource intensive result using simpler social engineering techniques or just finding overlooked physical security weaknesses.


Is SSL Interception possible without disabling Public Key Pinning on the client side? I'm currently setting up a pfSense firewall in my lab. It supports SSL Inception which works pretty well for most sites.

But there are some sites which use HTTP Public Key Pinning to prevent MitM attacks and this is a real pain because the systems behind the firewall have not just been setup and have pinned public keys in some cases which then breaks SSL for those sites.

One way to get around this is disabling HPKP which is possible in firefox by setting security.cert_pinning.enforcement_level to 0 and it works well. Is there another way to get around this problem?

// The host I tried this on was a Kali machine with the Iceweasel browser.

The Error that was shown to me said the connection was droppen because of HSTS which was of cause very confusing because there were also websites that are using HSTS and the interception worked just fine. I then figured out that this seemingly has to do with HPKP and after disabling it the HSTS errors didn't show up anymore.

This seems to be a software specific issue. After @Steffen Ullrich Pointed out to me that this should not be happening I tried it with a Windows 7 Client and Chrome as a browser and it worked just fine.

In case of legal SSL interception the proxy CA which is used to issue the certificates for the intercepted connections gets explicitly imported into the browser/OS as trusted. In such a case browser will ignore both the builtin pinning and also the pinning done with HPKP header. This is explicitly done this way to make legal SSL interception (in firewalls, for security reasons) possible. Which means there is no need to disable public key pinning in such cases.


SIEM-like tool for pcaps Is there any tool that accepts a packet capture file as input and displays all the network traffic in a similar way to how a SIEM displays log information? I'm looking for a summary of the ports and IPs to get a good overview of a packet capture.

There are some great platforms in this arena, the first I ever heard of, SecurityOnion. It's still great after all these years
There are also other platforms such as Malcom and VAST that have different perspectives.


can one stop spam with my name but not my address IS there a way to stop getting spam that is from my name but not my e mail address  I am receiving many spam letters using my name but different e mail addresses.

You can try to filter spam messages. First of all, check if your email provider has enabled spam filter for your account. There is a lot of anti-spam techniques which can be employ to help your problem:

RBL,
URIBL,
SPF,
greylisting,

and a lot of others.

On the other hand, if you are using local email client you can install some anti-spam plugin:

http://www.specificfeeds.com/blog/the-best-free-spam-filters-for-outlook-thunderbird-and-outlook-express/
http://email.about.com/od/outlookspamfilters/tp/anti-spam_ol.htm
https:__addons.mozilla.org/en-us/thunderbird/addon/emailsecurityplus/


Why CAs instead of global fingerprint database? Why do we use "too big to fail" CAs and the chain of trust instead of a global fingerprint database in a similar vein to how ssh works?

This is in fact two questions: why use CAs instead of a global fingerprint database, and why use CAs instead of doing what SSH does. There's no global fingerprint database for SSH, it's in fact the very opposite.

In the SSH model, there's no built-in way to obtain the fingerprint of a server other than by connecting to it. The usual model for security is that when you connect to a server for the first time from a given client, you are prompted to manually verify the fingerprint, and when you connect again, the client verifies that the fingerprint hasn't changed. A common case where this model just works is when the client is on a laptop and you perform the first connection from inside the same trusted network that contains the server. Other than that, you are supposed to verify the fingerprint out of band, but most users just type “yes”. This system doesn't really scale; it's workable when you only connect to a handful of new hosts per year, but not for something like the web where you might connect to several new HTTPS sites every day.

If there was a global fingerprint database, then it would for all intents and purpose be a universal CA. The definition of a CA is that you trust it when it tells you that a certain public key K belongs to a certain entity E. In the SSL protocol, a CA tells you this by providing a certificate that contains a cryptographic assertion that K is the public key of E. A fingerprint database, where you look up E and get K or vice versa, is a different implementation of a trust relationship assertion. So with a global fingerprint database, we'd have an even bigger “too big to fail” database.

An approach that avoids the “too big to fail” problem is the web of trust as used by PGP. The principle is that you know that K is the key of E because someone you know tells you so. This approach is reasonably well-suited to applications such as email, because many emails are sent between people who have a prior existing relationship, or who have common friends. It isn't applicable in a case like “I want to connect to this merchant's website”, where you'd never heard of this merchant before seeing a link to it on a price comparison site, but you want to know that the website belongs to a corporate entity that has been doing business for several years, and not to some drive-by scammer who'll take your money and be gone next week.

Having a single CA would raise concerns other than the risk to the integrity of the trust relationship database. When an entity registers a key, the CA is supposed to verify that the registrant has a valid claim to its purported identity (that the user registering a key for "Joe Bloggs" is really called Joe Bloggs, that the registrant for "Yoyodine, Inc." is indeed an authorized officer of Yoyodine, …), so the registrant cannot have privacy with respect to the CA. A choice of CA means that registrants have a choice of who they submit their private identity to. A state-run CA would be in a good place there because it knows the registrant's identity already — but which state? People may well want to declare identities that are not known to the state they live in. Another concern with a single CA is that it would have a monopoly on registration; having many CAs means that an entity is unlikely to be barred from participating.

A way to reduce the impact of a failure of a CA would be to routinely have keys certified by multiple CAs. This is something people often do in PGP-style web of trusts: I want to verify Alice's key, so I ask Bob, who tells me that the key is correct. But while I'm sure that it's Bob telling me this because I've verified his key, I don't completely trust Bob to have verified Alice's identity. So I also ask Carol, and Dan, and so on. With many converging presumptions, I get a better assurance that Alice is who she claims to be. In the same way, having a website's key certified by multiple CAs, and not revoked by any, would reduce the concerns that one of these CAs may have been compromised or may have been lax in verifying the registrant's identity. However, this would require updates to a lot of software that verifies SSL certificates and increase the cost of key registration.


Does phishing include ransomware? Does the definition of phishing also include tricking the victim into executing malware, such as ransomware, that's not used to retrieve the victim's information?
As I see it, Wikipedia's definition of phishing does not include ransomware:

Phishing is the fraudulent attempt to obtain sensitive information or data, such as usernames, passwords and credit card details or other sensitive details, by impersonating oneself as a trustworthy entity in a digital communication.

Contrary, this guide from SonicWall does include ransomware in the definition of phishing:

One of the most common distribution methods of ransomware is phishing emails. These types of emails attempt to entice recipients to open an email and click on a website link. The site may ask for sensitive information or contain malware, such as ransomware, that is downloaded onto the victim’s system.

Proofpoint, too, includes ransomware infections as part of phishing:

“Phishing” can mean different things to different people, but we use the term in a general sense. In the context of this report, phishing encompasses all socially engineered emails, regardless of the specific malicious intent (such as directing users to dangerous websites, distributing malware, collecting credentials and so on)

I know about this discussion, but could it be that there's a specific and a general definition of the concept of phishing? Or is there a case for saying that there's only one definition (making the specific or the general definition incorrect)?

The term you're looking for here is social engineering. This is an umbrella term that describes any attempt to get a person to perform a particular action - particularly one that benefits the social engineer over the victim.
Phishing is a specific type of social engineering that is generally used to mean tricking a user into giving away sensitive information, but the terminology is not so rigid that the average security professional would frown upon you using "phishing" to refer to tricking a user into installing ransomware.


How does detecting promiscuous mode using an ARP test work? I have read that we can detect whether a system is running promiscuous mode by sending out an ARP request with a fake broadcast address e.g FF:FF:FF:FF:FF:FE.This will be blocked by all NIC's operating in normal mode but will be allowed by NIC operating in promiscuous mode and thus it will respond to the message.But I am a bit confused:

1.Won't the system in promiscuous mode respond to the ARP request only if it's IP matches      the IP in the target(destination) field  of the ARP request packet.

2.If we were to go by the above logic then all the systems will respond to an ARP(broadcast)request packet since it would pass through the Hardware filter(NIC).

3.Suppose only that system in promiscuous mode responds to the fake broadcast ARP packet which has the same IP as that in the ARP (request) packet destination field,then how do we find all systems(on that subnet) operating in promiscuous mode,without targeting a particular IP.

Thanks

It is at first a little counterintuitive, as the Ethernet address is a 'fake' broadcast address, but the test itself is not a broadcast test. It is targeted at only the destination IP address. You would need to target each individual IP on your subnet, ie do a scan.

However note that it is relatively easy to not be detectable, by using a Lan Tap. It effectively connects the sniffer in parallel to another device but has the Transmit wire disconnected (ie it is not possible for monitoring device to respond to anything).

For further reading: http://www.securityfriday.com/promiscuous_detection_01.pdf


Cheap and efficient strategy to protect against professional attack? With things like NSA or state sponsored attack, it seems that no one is safe from a  technical point of view. Is there any efficient method or strategy to protect against them?

My guess is that relying on technologies is the worst method, as it is very hard (even at large corp) to be better than state sponsored employees.

A method I can think about: I often use a physical layer between network, for example, a computer is connected to the network, but if there is important information, I use a USB to copy data from that computer to another computer that is disconnected from internet, or between them. Work and data on that disconnected computer is quite safe, isn't it?

The data may be exposed in connected computer for a very short time, but may be encrypted before that. Password can be transmitted with a different route, e.g. phone or in physical device. The USB may be compromised but it is a much easier problem. Also desktop computer is quite safe as it doesn't have any wireless connection that may be turned on without alerting user.

From a defensive mindset, what can you do?

With your disconnected computer, you are describing an Air Gap.  A quote at a recent security conference:  "An air gap just means higher latency in the network"

You are right that it is very difficult to be perfectly secure. Instead of trying to be perfect, try to improve.  Do a self-assessment and calculate what your biggest risks are and then use technical and non-technical solutions to reduce those risks.  Then, repeat.  An air gap might indeed be one of the technical solutions.

You don't necessarily have to be better, technically, than the state-sponsored attackers.  They are limited by the same technological realities that you are.  You do, however, have to invest resources (technical, human, financial) in a defense-in-depth strategy that takes into consideration possible bypasses employed by state sponsored attackers.  There are smarter people than you and me working on defensive strategies, so your resources should be devoted to following the experts and letting them help you reduce risk.


PCI P2PE running as independent software on POS? I have failed to find a good diagram or explanation of how a P2PE solution manifests itself within a point-of-sale (POS) device.  Is it software running in a process on an embedded OS that knows how to communicate with the card reader?  Or is it software that has been loaded into the card reader? Or what?

Related to this is that I failed to find a good diagram or description of how the various sub-components of a POS device relate to each other.  Presumably there is an OS (maybe embedded) and various I/O devices, and maybe some processes that have nothing to do with cardholder data.

Related to this is that I have failed to find a good description of the differences and relationships between the following: P2PE, PIN pad, PTS, POS, payment terminal.

I guess it depends on what you mean by POS, because this isn't really a defined term.

A POI (point of interaction) is something typically that interacts with a card and a person. Some POIs have card readers and PIN entry bits, some are just secure card readers, and you can get separate PIN entry bits that don't read cards (think of an ATM where the card reader and PIN pad are separate). In retail you usually interact with a POI device (aka chip and PIN machine).

A P2PE solution requires software running inside a POI such that the card data is encrypted within the secure processing area of the POI. The POI has to have a facility called "SRED" - secure read and exchange of data, not all POIs have this. Data is then only decrypted in the (hopefully) secure data centre of the solution provider.

This is not a bad explanation: https://www.pcisecuritystandards.org/documents/P2PE_At_a_Glance_v2.pdf


Are reCAPTCHA enough to prevent brute-force password guesses? I was wondering if reCAPTCHA were strong enough to prevent BruteForce from bots or if I needed to add more security, such as sending a unique mail to the user every 5 tries that someone try to log on the account and block the account while the mail isn't checked.

The aim is to prevent automated password guessing on a website.

ReCaptcha is great from a client side point of view, but it's not perfect.

The mail technique that you mention is called account lockdown, and is a very effective deterrent against brute force attacks. I would implement it because it's an added layer independent of the client side completely.

Another measure you can implement is throttling. It's unrealistic for a human to send 2 requests within 1 second (or any value you consider appropriate), so you limit the frequency of accepted connections. In iptables you would do something like this:

iptables -I INPUT -p tcp --dport 22 -i eth0 -m state --state NEW -m recent --set

iptables -I INPUT -p tcp --dport 22 -i eth0 -m state --state NEW -m recent --update --seconds 60 --hitcount 4 -j DROP

(Example taken from debian-administration.org.) This will limit requests to port 22 to 3/minute, any other request will be dropped. This can be useful for other operations besides log-in routines.


Checklist for securing smtp What are some things, one should know when setting up an SMTP server, which supports ESMTP protocol. I have disabled relaying, and only enabled TLS authenticated transfers.
when I telnet to my server, this is the reply:

250-mail.example.com
250-PIPELINING
250-SIZE 10240000
250-VRFY
250-ETRN
250-STARTTLS
250-ENHANCEDSTATUSCODES
250-8BITMIME
250 DSN

Should any of these be turned off? should anything else be enabled

You should disable the VRFY and / or EXPN these commands can expose user information to people probing a system in preparation for an attack.


What are some good ways to verify user identity for password resets? I'm wondering how others verify the identity of users they're resetting passwords for. We currently try to speak to a manager at work, but it frustrates end users and seems like we don't trust them. I've heard some say that sending the password via SMS has worked for them, and it seems like there's a reasonable level of security there, but only if users' cell phone numbers are already on file.

Essentially handling this revolves around having some combination of factors that can be used to assure that the user requesting the reset is the same person who has authority to the account.

As you've noted in your question one of the problems tends to come where retrofitting a password reset system to an existing application as the required information may well not have been gathered initially.

Methods I've seen include

e-mail address.  I primarily see this on websites where the user has registered with that address and therefore it's used as the reset location.  If you have that and no other information it may be a tenable solution.
SMS messages.  Mobile phones tend to be unique to a given person in most cases, so reset to phone (either by voice call or SMS) could be a decent option.
Online reset with management approval.  Heavy to setup but I've seen systems where if a password reset request was made e-mails were sent to "approved" persons (eg, manager) and those persons then confirmed the request (handy in big companies to reduce helpdesk costs)
A Bad option (from a security standpoint) that I've seen is confirmation of some personal information that the company may have about the staff member (eg, staff ID, managers name, dept name etc)  This might be reasonable with regard to complete outsiders, but there's a big risk of internal users already knowing thise

Ultimately the checking with managers option is also common and hopefully users could understand that it's not IT staff not trusting them, but that IT staff have to make sure that someone else doesn't access their accounts without authorisation..


AV boot disks and Truecrypt encrypted drives I was wondering if there were any "how-to" guides on what is needed to modify AV boot disks, such as Sophos, kaspersky, AVG etc  in order to load the decryption drivers/bootloader for Truecrypt before scanning?

Or other Disk encryption tools for that matter - Safeboot for example

As a precaution we periodically boot scan with alternate AV, but for Windows laptops we'd like to provide disk encryption as well, by default this would break the bootscan routine unless we can load the decryption onto the cd.

Your question calls for knowledge of Windows (DOS) batch files. You would need to make a bootable disk containing a batch file that will 1) mount the TrueCrypt voume and 2) then run the desired AV app.

Batch files have fallen into disuse, you might want to ask your Dad :)

First, search the internet for your favorite method of creating a bootable USB drive or CD for your version of Windows.

Next, you will need to create a batch file named autoexec.bat . This is a text file that you could create in Notepad, the extension .bat indicates it is a batch file and the reserved name autoexec.bat tells Windows to run this file at startup. A batch file is merely a list of commands such as you would type at a Command Prompt.

You can find TrueCrypt command line syntax at:
http://www.truecrypt.org/docs/command-line-usage

You can find command line syntax for your preferred AV product by searching the internet or your AV provider's site, for example for Sophos:
http://www.sophos.com/en-us/support/knowledgebase/13252.aspx

You might also want to put copies of the TrueCrypt and AV program executables on the USB drive or CD.


Disk encryption with OTP to protect source code We have to ship a hard- and software prototype to a customer for a first field test. The software is just not ready (protected - too much Python code) for distribution without the possibility, that someone extracts to easy our code and algorithm (I know, there is not really a 100% security anyway).

My idea is to give the customer a proprietary laptop with our software. The disk of the laptop is fully encrypted and can only be decrypted with a one time password. So the customer has to power on the laptop all the time. The software would be executable only (chmod +x) and inside the root folder. The whole disk for the customer would be no-read/write or read-only.

Any ideas on that, if this could be possible? Maybe with LVM (luks)? I know, there exist some OTPs but mostly for unsecure network connections or only parts of the disk, when the OS is already started. Do you know another workaround to accomplish this?

Send one of your engineers with the laptop. Rationale:

If it's important enough to send a laptop, it's important enough to send a person
There will be no problems caused by ad-hoc encryption and lock-in
If there are (other) problems he'll be able to solve them
No problems with the client copying the software or hardware
Your guy will learn a lot from the client about what the client expects and needs
If your hardware and software are not GA quality I expect your documentation isn't either
Above all you avoid the situation where your prospective client finds himself with a laptop he cannot use for some reason, and decides your product is not good

But do write up an NDA agreement too, of course.


OpenSSL check if a SSL certificate is SHA-1 or SHA256 signed How do I check if an OpenSSL certificate issued to a site is SHA-1 or SHA-256?
I have a quite a lot of intranet sites using OpenSSL certificates and I am a bit confused as when I check the certificate properties, I get:

Internet Explorer:
Signature Algorithm: sha1RSA
Signature Hash Algorithm: sha1

Firefox:
Signature Algorithm: PKCS #1 SHA-1 With RSA Encryption
Under Fingerprints, I see both SHA256 and SHA-1

OpenSSL command line attempt not working
I tried using OpenSSL command, but for some reasons it errors out for me and if I try to write to a file, the output file is created, but it is blank.
openssl.exe s_client -connect mysite:443 > CertInfo.txt && openssl x509 -text -in CertInfo.txt |
find "Signature Algorithm"

Basically, I need to validate that the certificates are really SHA-1 and I need to upgrade that to a SHA256 or SHA-2.

Here's the command for Linux and Windows.
And don't be alarmed about the doubled output line (Signature Algorithm: ...). That is expected (and mandatory).
Linux: SHA1 demo site
$ echo '' | openssl s_client -connect sha1.badssl.com:443 -servername sha1.badssl.com 2>/dev/null | openssl x509 -noout -text | grep 'Signature Algorithm'
    Signature Algorithm: sha1WithRSAEncryption
    Signature Algorithm: sha1WithRSAEncryption

Linux: SHA256 demo site
$ echo '' | openssl s_client -connect sha256.badssl.com:443 -servername sha256.badssl.com 2>/dev/null | openssl x509 -noout -text | grep 'Signature Algorithm'
    Signature Algorithm: sha256WithRSAEncryption
    Signature Algorithm: sha256WithRSAEncryption

Windows cmd.exe: SHA1 demo site
c:\>echo " " | openssl.exe s_client -connect sha1.badssl.com:443 -servername sha1.badssl.com 2>nul | openssl.exe x509 -noout -text | findstr /C:"Signature Algorithm"
    Signature Algorithm: sha1WithRSAEncryption
    Signature Algorithm: sha1WithRSAEncryption

Windows cmd.exe: SHA256 demo site
c:\>echo " " | openssl.exe s_client -connect sha256.badssl.com:443 -servername sha256.badssl.com 2>nul | openssl.exe x509 -noout -text | findstr /C:"Signature Algorithm"
    Signature Algorithm: sha256WithRSAEncryption
    Signature Algorithm: sha256WithRSAEncryption

Fingerprint is not inside certificate
It's a computed value.


Is traffic subsequent to a SASL/GSSAPI bind encrypted? When making a SASL/GSSAPI bind to an LDAP server over port 389 (ldap:///), after the authentication is finished is the resulting LDAP traffic encrypted? If so, is there a document or RFC that describes this?

Assume that no STARTLS command is issued by the client.

Note that the question "Is it secure to be using LDAP, or is LDAPS the only secure option?" mentions some ways to secure an LDAP connection but does not address the question of whether or not connecting via SASL/GSSAPI encrypts subsequent data communications.

Unless you are explicitly using LDAPS on port 636 or TLS over 389, then you are not using encryption. You can verify this with a quick packet capture. I wouldn't even trust that your authentication credentials are protected, but I am not aware of what protections that exist there.

Edit: I may be wrong. It appears that there are some modes of SASL that provide some confidentiality (source):

  In additional to authentication, some SASL mechanisms support integrity and privacy protection of the communication channel after successful authentication. With integrity protection, subsequent LDAP requests and responses are protected against tampering. With privacy protection, subsequent LDAP requests and responses are encrypted and therefore protected against unintended monitoring. Privacy protection automatically entails integrity protection. These different types of protection are referred to as the quality of protection (qop). It is negotiated between the client and server during the authentication phase of the SASL exchange. If the client and server cannot negotiate a common qop, then the SASL authentication fails.

That said, I do not know how thorough this protection is. See this answer for a more in depth look.


Protecting my machine from running untrusted applications I was big fan of the Toontown Online MMO when Disney used to run it so I was excited to learn that it had been revived by a fan or group for fans building on the original source code. During a recent update, my virus checker said there were questions about the new installer executable, and that they were looking into it. That made me realize that although I'm usually very cautious about what I click, download, etc, in this case, I didn't even think about the issue of security.
(Note: I'm not sure but this may be what was developed by the person who posted this:
https://stackoverflow.com/questions/20296611/python-server-emulator-for-toontown )
My understanding is that you can't really do real-time protection on the traffic between the server and the engine on your PC but I don't really know enough about the process to make an informed decision as to how vulnerable it might be, especially given the current smaller third party nature of the MMO.  I know this forum isn't for the question "Should I use it or not" but any advice, insight, etc into the security issues so that I can make an informed decision would be appreciated.
I do have two questions that focus on more specific details of the issue.
First, I am thinking about switching my anti-malware software to PCMatic, which I guess uses a whitelist approach instead of a blacklist approach.  Would this be effective in preventing anything a hack would do from installing additional malware?  And would it fail to prevent redirection to a malicious web site or would it catch it?
Second, is there some way I could use virtualization to create a sandbox that would run the program and isolate it from the rest of my system in case there are any issues?  I'm in the middle of researching VPN vs virtual machines because I don't truly understand the concept yet, but (assuming they're truly different things) would one or other or both allow me to do that?  Or can I do the same thing by say installing Linux as a dual boot OS and use that only for TT?  Or is the second OS not really isolated and thus safe?

VPN is to virtual machine as air conditioning is to a couch. Very different things.
You have to get clear on what you want to be protected from:

Traffic coming from your machine (to something malicious)
Malware installed on your machine

Those are 2 very different problems. And a VPN protects you from neither.
A Virtual Machine can be used to limit the damage an infection can cause. Unless the infection is extremely advanced, it can only damage the VM. Dual Booting does not provide any isolation at all.


Added value of Windows Server 2008 over 2003 in terms of security What is the added value of a Windows 2008 Server over Windows 2003 in terms of security?
Does Windows Server 2008 has enhanced/new security features compared to 2003?

There's a lot of added value in Server 2008 as compared to 2003. You can, roughly speaking, think of Server 2003 as "XP" and 2008 as Vista. In which case the following are notable changes that impact security:

UAC, UIPI are brought in in Vista. That is, Administrator users are handed two authentication tokens - one with full admin privileges and one with filtered privileges (standard user privs). This is what explorer starts with, thus, most apps are run as a standard user by default, even on an admin account. UIPI allows these windows to share a desktop whilst theoretically keeping them isolated.
Address Space Layout Randomisation. Vista got a full implementation of this.
Proper logon credential handling - whereas previously one could totally re-write the logon dialog with a GINA, now you install credential providers. Risk of intercepted passwords is thus decreased.
In 64-bit versions of XP and Vista, Kernel Patch Protection. Prevents rootkits from hooking interrupt tables by force-bluescreening Windows if they do. Very handy.
A series of protocol improvements were introduced, possibly most notably SMB 2.0.
and so on...

The Vista kernel and operating system was in many ways a very audacious release, containing a whole slew of additional features. There really is no reason to stay on 2003 if security is your end game.
That said, if you're considering an upgrade, practicalities come into play. Server 2008 R2 is already in production use and Server 8 is not that far distant either. I wouldn't upgrade to 2008 given the choice of R2 or Server 8 - I'd be inclined to wait for S8.


DMZ layer for web server/presentation layer I need help explaining to non security people why I want to require the webserver/presentation layer in a dmz.  I've given options for a tier two (presentation/logic -> logic/data in zones) architecture and an three tier architecture (presentation -> logic -> data zones).

Their argument is that I should be fine with firewall -> F5 with ASM -> firewall -> Presentation/Logic/data layer all in one zone.  Their argument is that this is a two tiered architecture so should count to meet my requirement.  I've asked them to find me an industry standard document explaining security design this way and have been stonewalled -- probably because there are not any.

I'm having difficulty explaining that the first thing a hacker from the internet touches should be dead ended and prevent north-south movement into the next zone.  They want it in terms of architectural capabilities.

An ideas on how to explain a two tier application security design architecture in terms of architectural capabilities?  Any other ideas would be helpful too.

ASM, and other WAFs, are excellent.  They are not exactly a "tier", though.  The point of breaking things into separate security zones per-tier is defense in depth.  What happens if there is a remotely exploitable buffer overflow vulnerability in the service used for the presentation layer?  (*I know.  Impossible!  http://thehackernews.com/2013/11/Vulnerability-JBoss-Application-Servers-exploit-code.html)  You need 100% trust that the WAF will block it, despite whatever obfuscation technique thrown at it.  That is a lot of trust.  If the WAF fails to catch the issue, you are toast.  The hacker owns EVERYTHING.  They are inside the network and able to do whatever they want.

By layering you can limit damage and increase the chance of detecting a penetration.  Firewall -> WAF -> Presentation/Logic -> Firewall -> Data, at a minimum.

That's not all, of course.  You still need things like stored procedures and a heavily restricted user for access from Logic to Data layers.  The WAF might miss a clever SQL injection.  Maybe that data layer should also be in a DMZ of its own.

Keep in mind this is all logical separation.  One firewall cluster, one F5 cluster, one hypervisor cluster, and one pair of VLANed switches would support any one of your proposed layouts without blowing hardware costs out of proportion.  I am betting they are thinking adding security zones means lots of added hardware and complexity.  It doesn't have to.


RCE vs ACE vulnerability families Is RCE (Remote Code Execution) just ACE (Arbitrary Code Execution) over a network or is there an example where RCE is not ACE? Is RCE always the more severe of the two (with respect to gaining system admin privileges), or would it depend on what application has the vulnerability (and system privileges that app runs with)?

Arbitrary code execution, allows an attacker to run any code target system. Based on the Attack Vector we can divide the arbitrary code execution into two categories: remote and local.
In general, I would say that remote code execution is more severe as the name suggest can be exploited over the network, which is much more dangerous in those days when everything is interconnected. Of course, there are also other factors like what type of privileges are required, user interaction, attack complexity, etc.
You can play with NIST CVSS calculator and see how the individual metrics project into the score. The score can be roughly translated into the severity of the vulnerability.


Fingerprinting Hash Function For the purpose of fingerprinting data with the least chance of collision will combining the length (as a 32 bit unsigned integer stored in addition to the hash) of the input data and/or sampling a few bytes from the input significantly strengthen the resulting output combined with the hash?

For example:

sha256(data) + length + first_2_bytes_of_data = 304 bits

Note: (updated)

The privacy of the input data is not paramount, more the ability to detect if the data has changed.
Also I use a 256 bit hash function in this example but the question is less about the final choice of hash function and more about will adding the 6 extra bytes help.
The length in bytes of the input data will always be variable but always less than or equal to 2 to the power of 32.
The resulting output will be used both for integrity verification and as a dictionary key for up to 2^64 items (if key collision is considered unpractical or impossible)

No, adding such side information does not really help to strengthen the resistance to collisions, for a cryptographically secure hash function such as SHA-256 already takes into account the length (through explicit inclusion in the padding, see §5.1.1, page 13 of the FIPS 180-3 standard) as well as every single bit of the input data to compute the digest. There is no known collision for SHA-256 nor is there any publicly known promising method to find one.


How useful is it to prevent Linux applications from setting up any untrusted connections, and can it be done easily? Threat: your Linux machine gets compromised in some way (untrusted app, or compromised install package or update, or an app is compromised because of a vulnerability, etc.) and something on your system tries to "call home". So you want to prevent the call, basically neutralizing the vulnerability. You would spot it because you might see a notification saying "Gimp wants to connect to example.com on port 80: allow, allow once, deny?". I think it makes sense as a defense, doesn't it?

Yet apparently, if I'm not mistaken, there are no easy ways to do this on Linux, and no popular and trusted applications have been developed for this purpose (I googled and found several questions about this even here on stackexchange). Applications like AppArmor or SeLinux have been developed to control which files a process can use, but the same hasn't been done for network connections. On Windows such applications are very common and part of firewalls. Is there a reason the same has never been common on Linux? I don't think configuring the allowed network connections can be harder than configuring the allowed files in AppArmor or SeLinux, so it can't be a matter of usability.

I have to say maybe I've found a way to circumvent such methods. Most users will probably have to set a rule that allows the browser to connect to any host on port 80. Therefore malware could just try to copy itself inside the browser (patching it or as a plugin), and then it would be free to connect anywhere on port 80. Nevertheless, I don't think this makes trying to avoid untrusted connections totally useless. By the same reasoning, malware could patch AppArmor or its rules to be free of doing whatever it wants, but this doesn't make AppArmor totally useless.

You bring up a good point. EDR (Endpoint Detection and Response) has been created for this very reason. Vendors such as Crowdstrike do a great job at protecting endpoints. To my knowledge, most EDR software is developed to be invisible to the end user. Mostly because hosts are centrally managed by a administrator. A decent EDR would detect when a user downloads and runs a new application and you can track everything the program does, such as making outbound connections.

This type of software has to be very robust and smart so it is usually expensive. I would guess that is the most likely reason why it isn’t pre-installed on most Operating systems.  EDR is available for most operating systems, Linux included.

To answer your question directly, it is very useful to monitor network connections from I trusted apps and it is usually difficult to do so effectively.


How do attackers put malware into pirated software? I have just started Reverse Engineering and Malware Analysis. I wanted to know what is whole process by which attackers put malware into software after cracking it, especially without affecting the functionality of the cracked software?

It's a bit of a broad question, as there are many different ways to do this, so I'll just mention a few that come to mind.
A simple way would be to replace the program's installer completely. This way, the installer can just replicate what the original installer does, but while also performing malicious actions. This also has the advantage of usually being run with elevated privileges.
Another simple way is to write a wrapper around the executable. When the executable is launched, the malicious code can run, and the existing application can be kicked off in parallel.
If the program ships with libraries in the form of DLLs/SOs, they could be replaced to include malicious code.
Lastly, the executable itself can be patched to include malicious code; see The Backdoor Factory, which is a tool to automate this.


Does having Frontend and Backend on the same port any consequences? I am currently working on a mean application, with an Angular frontend and an express/node backend. Frontend and backend communicate together with a REST API.

When I deploy the application, both the Angular front-end and the API back-end are served from the same port.

What consequences do running both on the same ports have, instead of separate port for each part?

Let's say you have 2 Servers running different APIs and want them to communicate with each other. If client and server are on the same port, they will not be able to communicate since the port is already on listen mode.


Aireplay-ng broadcast doesn't work on a client Launching Deauth attacks on my BSSID disconnects all devices except one. I figured out that in order to make it work I have to use the -c command to specifically deauth that client, but is there any way to deauth it by attacking the BSSID? I've confirmed that the device is connected to the correct network.
ps: The device that can't be deauthenticated is a Windows 7 machine.

Why does deauthentication not work?:

  Some clients ignore broadcast deauthentications. If this is the case,
  you will need to send a deauthentication directed at the particular
  client.

I see nothing else to be added to this.


Will two virtual machines running on the same physical host machine get the same value from /dev/random? Will two virtual machines running on the same physical host machine get the same value from /dev/random if read over the same time period?

Say that Virtual-machine-1 wants to generate its ssh host key. Virtual-machine-2 the random sniffer on the same physical host hosting the virtual machines saves /dev/random to a file on the disk. Is the random entropy the same between Virtual-machine-1 and Virtual-machine-2?

Would that make it easier to crack the crypto keys?

No, because /dev/random gathers environmental noise from device drivers. So unless you happen to have exactly the same events happening at the exact same time in both VMs, their random pool will differ enough to make this kind of attack impossible (or at least infeasible).


How secure is a 100-bit password in 2018 and onwards? Long story short, I share a server with a few other people and store my backups there. All these backups are archived to a .7z file using AES-256 encryption, using a randomly-generated password of about 100 bits of entropy. Assuming my backups became public, how hard would it be to access their contents in 2018 and beyond?

All of the comments assume a brute force attack against the encrypted file.  In cryptography, however, this is far from the only attack to consider.

As an example, AES-256 is generally considered 'computationally secure' by modern standards but there a lot of assumptions in just saying that. Computationally secure means that while it's secure by modern standards, history has proven it won't always be secure.
 AES operates in different modes (CBC, ECB, CFB, OFB, CTS) -- each with their own targeted attacks against each mode.

As an example in Cipher Block Chaining, after the first round, the cipher text from the previous round is xor'd with the plaintext in the current block but circling back to the first round, the encryptor must be provided the first bits of randomness (called the Initialization Vector or IV).  If this isn't done properly, this can be used to systematically derive the ciphertext that's xor'd in all for each subsequent blocks and thus, providing the unCBC'd ciphertext that can be statistically analyzed or brute forced to derive the key.

Additionally, your password can be targeted.  You already leaked some interesting information about it.

You said it was randomly generated with 100-bits of entropy and
around 20 chars.  With that, I can roughly derive the keyspace and
probably make an educated guess as to the randomness (uppers, lowers,
numbers, and a handful of common specials).
You said it was randomly generated... was it cryptographically randomly generated or did it use a pseudo-random number generator?  Most PRNGs have significant weakness (e.g. based on atomic clock values) -- so if I know when the file was created, file metadata or in the filename itself, I might be able derive the seed and generate the same value you did at that time, thus significantly limiting the effectiveness of the 'randomness' almost to the point of negating it.
You said it was a passphrase, and not a password.  This also leaks information.  If true, it means your password probably isn't really cryptographically secure (e.g. 1r5%vb9*?_ad!@KLvnd) and probably something closer to I<3G0ldenR3tri3v3rs!!.  L337 speak is not cryptographically secure and good cracker will have dictionary files with common l337 speak variations on common words to significantly lower the time to crack.

So... to answer your question on how hard would it be to access their contents in 2018 and beyond? -- it highly depends on a number of factors.


What happens if I reuse passwords I want to understand the risk in reusing complex password.

Unique complex passwords for each and every email account, say 3.
All other accounts, bank, medical, social, share a complex password, 1
This makes a total of 4 passwords.

LinkedIn account gets hacked, emails and passwords are lifted.
How does this affect security of other bank, medical, and social sites?
Note as an aside, many financial sites limit  passwords to alphanumeric, still!

The bigger problem is not your linkedin account getting hacked, it's Linkedin itself getting hacked and all users emails + passwords becoming avaiable
To unlikely? It already happened before. Adobe, eBay, Yahoo, PlayStation Network, the list goes on... all of these companies have had their database hacked and users emails and passwords leaked in the past (some of them, twice).
So, if you want to be safe, you should not use the same password for more than one website. Yes, that may be extremely annoying, but it doesn't have to. You can use a password manager that generates unique strong passwords for every account you create and stores them for you. Of course, this leads to a single point of failure, so you should use a very strong and unique password on the password manager. You can browse all about this if you want to know more.


iPad accessible when I connect to internet? At one point today my teacher was saying that we shouldn't have social media etc. They also at one point said that the school could access (and view "everything") on our iPads when we are connected to the internet. They did say that the school decided not to do this, but it still bothers me that a network that I connect to has control over my iPad.
So my question is... is this actually possible, can I protect my iPad against this? Can I do this? Or is my teacher just trying to make us not do anything bad on our iPads? (Is there something that Apple gave them to get into iPads?)

If it's your device, then the short answer is no, you'd have to give them permission. They can view network traffic coming to and from your device, which may be what they're talking about.
Most BYOD management tools  - for example, if you're connecting your iPad to a school or business network and installing specific applications - create a separate partition for the purpose.  The administrator typically has control just over this partition - they can remotely wipe, install, etc - but will have no access to your personal data.


Do I need CSRF token if I'm using Bearer JWT? Context: Angular site is hosted on S3 behind CloudFront, separate from Express server that is used as API and almost all requests are XMLHttpRequests. All requests are sent without cookies (withCredentials = false by default) and I use JWT Bearer token for authentication by taking it from cookies in angular and placing to Authorization header (This technique is kind of what is described in CSRF Wiki page).

On Express site I do not allow Cookie header in Access-Control-Allow-Headers.

Cookies have secure: true flag, and are NOT httpOnly because I need to manually access them in angular.

Also I've read in this Medium article that JSON-Web-Tokens(JWT )/Bearer Tokens

  is without a doubt one of the best methods of preventing CSRF

Question 1: Will I add extra security if I'll add X-XSRF-Token header to each request and for example make the mechanism stateless by checking for that same value in JWT payload? (I'we read about it in this thread)

Question 2: Do I actually need extra security efforts agains CSRF taking all that I described?

This is relevant but doesn't necessarily answer 100% of your question:

https://security.stackexchange.com/a/166798/149676

The short of it is that as long as authentication isn't automatic (typically provided by the browser) then you don't have to worry about CSRF protection.  If your application is attaching the credentials via an Authorization header then the browser can't automatically authenticate the requests, and CSRF isn't possible.  Therefore, I would re-word the quote from your article slightly: it isn't that Bearer Tokens are the best defense against CSRF attacks, but simply that CSRF is an attack vector that specifically attacks requests where the browser automatically provides authentication (typically cookies and basic authentication), and so CSRF doesn't matter if the browser can't authenticate you.

You should probably make sure and verify, server-side, that your application isn't silently falling back to cookie validation if the Bearer token is absent.  I could see something like that squeaking into an application by accident, and since the cookies will get sent along whether you want them to or not, it could result in an inadvertent CSRF vulnerability on a page that is was "supposed" to be immune to CSRF.

As a result, I think both your questions one and two can be answered the same way.  If you only use authentication via Bearer tokens and not via cookies, then there is no concern of CSRF vulnerability, and no extra steps are required for security.


Why does healthcare.gov exclude some special characters from passwords? The site does not allow the following characters: = ?<> ( ) ‘ " / \ &

It also limits maximum password length to 20 characters.

This makes me suspicious that they might be being stored in plain text and inputs aren't being sanitized properly. Is there any other reason for this type of restriction?

I don't think this is a duplicate of Why Disallow Special Characters In a Password? because this is a rather new website that doesn't (to my knowledge) need to integrate with any old financial systems.

Assuming they're storing their passwords hashed, a reasonable justification for restricting the sort of content that the password field is allowed to contain is simple input sanitization.

There are likely a set of rules that get applied everywhere unless the developer makes a special exception; that way the programmer doesn't have to remember to "turn the safety checks on" for a given component; everything is sanitized except where you have a justification for doing otherwise.

The characters that are getting filtered out are frequently associated with injection attacks of various stripes, and there's no reason why you need to allow those characters in passwords, and with no justification for disabling the security checks, the default policy applies.

Why 20 characters? It was probably the default in some component library.


What's the difference between these MD5 hashes? What's the difference between this format:
Hash found: admin:$1$$oLN1UCc1Y3T30QkMcKMSx0

and the following:
5f4dcc3b5aa765d61d8327deb882cf99

And also,
How to turn the first hash format into the second one?
Thanks in advance.

The first example looks like a shadow file format: ID (admin) Algorithm (1 = MD5) Salt (none) Hash (oLN1UCc1Y3T30QkMcKMSx0), with the hash in what seems to be Base64 format.
The second (5f4dcc3b5aa765d61d8327deb882cf99) appears to be a hex string of 128 bits consistent with being an MD5 hash as well.
However, converting both to binary & then back to their opposite formats, the two hashes do not match:

Base64 of the binary value represented by the hex string (5f4dcc3b5aa765d61d8327deb882cf99) is X03MO1qnZdYdgyfeuILPmQ.

Conversely the hex string of the base64 hash (oLN1UCc1Y3T30QkMcKMSx0) is
a0b3755027356374f7d1090c70a312c7.
       ------- Edit -----

As user1686 pointed out: oLN1UCc1Y3T30QkMcKMSx0 is MD5crypt, which is a thousand rounds of MD5 with extras at each round. If both of these hashes are in fact from the same password, it should be possible to convert the straight MD5 hash to its equivalent no-salt MD5Crypt by bypassing the first MD5 calculation in the MD5Crypt and feeding it the hash instead of the password.


Are NTP servers without monlist still dangerous? I've been studying DOS flood attacks, namely NTP and DNS floods. I know that monlist is the primary factor in launching these sorts of attacks, but I have one question. The problem is are these servers still dangerous without it it enabled? I mean if I tried to run a NTP packet flood without monlist enabled would it still cause a DOS attack or would nothing happen?

I think that the monlist is used for amplify the attach basically, so no the case of amplification attacks I don't think is a problem, however, the NTP servers could still be used for DoS attacks but not with amplification capabilities.


File carving JPG exif data files So I'm very new to info sec overall but I would say I am least experienced in Digital forensics, anyway I recently had the opportunity to work with professionals and we did manual file carving.

This was all fine and I could pull regular JPG Images out of hex easily and quickly. However I have only once been able to successfully pull out jpg that contains exif data.  I'm wondering if anyone has any tips and tricks for manual file carving these types of files (will also accept tips on scalpel ) as I am so fascinated by digital forensics and want to learn so much more.

Thanks in advance!

File Carving Tools: There are several paid and free forensics tools available. For instance, Autopsy is an open source digital forensic tool and it does pretty good job in file carving. It has different type of viewer builtin like text view, string view, hex view and meta view. You can also perform keyword searches. (check their official website for detailed list of features/options available)

There are two other choices available for image carving. The first is the open source photorec. The second is the commercial tool Adroit Photo Forensics. Adroit will recover files that are fragmented and does a better job eliminating false positives, but it is pricey. In all likelihood you'll be fine with photorec.

Carving with Scalpel: This type of carving requires in-depth understanding of file types and their behavior for example a pdf file starts with
%PDF and ends with %EOF while a jpeg image file begins with 0xFFD8 and ends with 0xFFD9 Now with this information, you can configure scalpel to extract JPG/PDF files.


Is the following a secure method for file encryption? So the goal is to use AES-CBC-256 to encrypt the data in a file. To derive the AES key and IV pbkdf2 will be used to generate a 384 bit output using a given password and salt, where the first 256 bits will be the key and the last 128 will be the IV. The key and iv will be used to encrypt the file and then a hash of the key will be stored at the beginning of the encrypted file so that when decryption happens, the hash of the supplied key will be compared to check whether the correct password has been supplied. Is this a secure method?

No, you should use Authenticated Encryption or AEAD.
My suggestion
Generate another 128 bits from the KDF, use that as the key to HMAC-SHA-256, compute HMAC of IV and ciphertext, store the HMAC result (called authentication tag) with the ciphertext.
When decrypting, pass the password through KDF to generate IV and HMAC key, compute HMAC  over IV and ciphertext, compare with stored authentication tag. If they don't match, the password was bad or the ciphertext was tampered with. Do not decrypt. Decrypt only if the authentication tag is good.
CBC is slow, because it has to work one block at a time and cannot encrypt blocks in parallel. CTR would be better.
HMAC is a strong MAC but is slow.
Modern AEAD modes like AES-GCM or even ChaCha20-Poly1305 (the only modes allowed in TLS1.3 and libsodium, preferred in modern SSH and IPSec, with ChaPoly being the only mode allowed in age and WireGuard and is the default in libsodium) are faster than AES-CBC or AES-CBC+HMAC.
But actually...
Using age would be much better than rolling your own. For example, age uses modern chunked AEADs and scrypt, has a go and rust implementation, and was created by a reputable person (the maintainer of go's standard library's crypto code).


Why is SHA-256 not good for passwords? I've just started learning about all of this and I can't really find an answer for that anywhere, namely why is SHA-256 not used for passwords? I found that the reason is that because normal SHA-256 is a fast function, and it's better to use slower ones, but here's the part i don't really get, from what i've read so far, SHA-256 produces a hash that'd take A LOT of years to crack, like A LOT A LOT, so why is it considered bad for passwords when it's basically impossible to crack?

It's all about reducing the overall risk of loss.  A good hash algorithm makes it impossible to reverse the hash value to compute the original text.  However, passwords are very, very short.  By making a guess at a password, the attacker can compare the output of his SHA-256 against the SHA-256 that he finds in the database.  And because passwords are so short, testing many password guesses this way is easy for a computer. For a few thousand dollars you can buy a small supercomputer dedicated to SHA-256 testing (used for bitcoin mining), which enables an attacker to test 16 trillion different password guesses per second.  That is much more effective than trying to break SHA-256.

Hashing passwords is not about trying to prevent the cracking of any one single password.  Web site owners are much more concerned because they have a database of a million users, and when attackers break in, they frequently steal a copy of the database of passwords.  They want to make it hard for the attacker to break all of the passwords in their database.

With the dedicated hardware (or an array of botnet zombies) an attacker can easily break the vast majority of passwords in a typical database where they are only protected by a single iteration of SHA-256.  And breaking passwords on one site enables attackers to take advantage of people who reuse their passwords on multiple sites. This is a precursor to performing Account Take Over (ATO) attacks, where they reuse the stolen passwords to access bank accounts or gift cards, and steal actual money.

To defend against this, a purpose-built password protecting algorithm is built as a time-waster.  For example, PBKDF2 executes a hash algorithm hundreds, thousands, or millions of times, depending on how you configure it.  This increases the amount of work that an attacker needs to do to execute a single test by that large factor.  If you set PBKDF2 to execute a million iterations, that would reduce the effectiveness of the box above to testing only 16 million password guesses per second.  An attacker would only be able to break a millionth of the passwords in the database when compared to cracking a database where they were stored as single SHA-256.  That's the risk reduction.


Is my understanding of SHA1 correct? My understanding is that SHA1 is a 'shared' hashing algorithm. As in, if somebody on the other side of the world on an entirely different system runs a string through SHA1, it will result in the same output as if I did on my machine, every time.

In which case, is the lifetime of SHA1, generally, very finite? In that, eventually all outputs can be attributed to particular strings with a 'brute force' type of approach?

I appreciate that, if this is correct, the above approach would take massive effort/processing time (similar to attempting to hit a matching pair of guids), but I'm just asking conceptually.

You are correct that SHA1 is deterministic - i.e. if you give the algorithm the same input, it will produce the same output not matter what computer you run on, where in the world you are, what year it is, the color or your skin or the content of your character.

There are an infinite number of inputs (any string), but only a finite number of outputs (160-bit string). Since the outputs are finite (just finite - there is no such thing as "very finite"), you are correct that in theory it would be possible to generate a "dictionary" with a matching inputs for each output.

You are also correct in your intutition that this might be practically impossible even if it is theoretically possible, given that that the dictionary would need to have 2^160 different entries. Here are two of the problems:

To make such a dictionary, you need to generate about 10^48 hashes. The universe is around 10^17 seconds old. So if you started at the big bang and generated 10^31 hashes per second you would be done by now.
To store such a dictionary, you would need around 10^50 bits of storage (10^2 per entry). That is roughly the number of atoms on earth.

You could off course make a dictionary for a subest - say the most common passwords - but doing one for the full output space is not realistic, even in science fiction. And if you did, it would just map the output to one of many possible inputs.


Securing remotely accessible IP cameras that do not support HTTPS I have some IP cameras set up on my home network, which is WPA2 protected.
These cameras are setup to be accessible from the Internet thru my router's DDNS address, and port number.

So for example, from my office PC I can go to http://urltomyrouter.com:12345 to see cam#1 after I input my username and password.

These cameras are Foscams FI8910W's and they do not support HTTPS. My router by the way is an Asus RT-N56U.

I assume that my credentials that I use to log into the cameras are being sent in plaintext and not encrypted, which is unsafe.

What are my options to fix this and make my access more secure?

I read somewhere that a "reverse proxy" is a possible solution but I'm not sure how that would work...

I'm going to assume your router isn't smart enough to set up an encrypted reverse proxy by itself.

Conventions Used Below

Home IP Address: 1.2.3.4 ( google search my ip to find yours )
WebCam IP Address / Port: 192.168.0.123 on port 456.
Linux/Unix Computer Running Reverse Proxy: 192.168.0.101

Initial Checks

On local network can you see webcam at http://192.168.0.123:456?  Great.  Can you not connect to webcam from the outside world (that is http://1.2.3.4:456 is firewalled off)?  Great.  If not reconfigure your webcam and port forwarding/firewall rules on your router.

Next, install a webserver on a computer on your local network that is on whenever you want to connect to your webcam.  I'm going to assume linux/unix and give instructions for nginx.

As a initial test, set up a reverse proxy with no encryption.  Install the latest version of nginx, edit the configuration file (/etc/nginx/conf.d/default.conf) and add lines similar to:

server {
  listen 8080;
  location / {
      proxy_pass http://192.168.0.123:456;
  } # replace with your webcam's local IP address and port.
}

Now restart nginx (sudo /etc/init.d/nginx restart) and try connecting to the proxy (http://192.168.0.101:8080) and it should work just like if you went to http://192.168.0.123:456.  If you have trouble, check everything again or consult the nginx documentation.

Getting A TLS/SSL Certificate

Now you need to add a SSL certificate and the associated private key.  You can generate one signed by a certificate authority (e.g., from startssl.com for free) or generate one yourself that is self-signed (and will not be initially trusted by web browsers).  Setting up a CA-signed certificate will be more complicated for a home network where you'll have to get a domain name (that you can prove to the CA you own), set up dynamic DNS to that domain name, etc.  (If you are trying to get started with Dynamic DNS - https://freedns.afraid.org/ is a great place to start).

To generate a self-signed certificate, first use openssl to create a private key (in this case a 4096-bit RSA private key):

# openssl genrsa -out private.key 4096

If you are curious you can view the contents with openssl rsa -in private.key -text -noout.  Next you need to generate a certificate based on that private key, which can be done with:

# openssl req -new -x509 -key private.key -out yourcert.crt -days 3650

The 3650 says it will expire in 3650 days (~10 years). Openssl will prompt you for more details, feel free to leave them blank or put any information in there.  (You can view the content of your certificate with openssl x509 -in yourcert.crt -text -noout).

Now put your private key and certificate somewhere safe (e.g., in  /etc/ssl/private/private.key and /etc/ssl/certs/yourcert.crt), restrict their permissions (make sure owned by root and no one else has read/write permissions).

Turn on SSL in Reverse Proxy

Then edit your nginx server configuration file to enable SSL as follows:

server {
   listen 443; # doesn't have to be port 443 - could be any port (say 8080) if you
               # connect via https://192.168.0.101:8080 .  But on port 443
               # you can just use https://192.168.0.101
   ssl on;
   ssl_certificate  /etc/ssl/certs/yourcert.crt;
   ssl_certificate_key  /etc/ssl/private/private.key;
   # certificate and private key where you just placed them

   ssl_session_timeout  5m;
   ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
   ssl_prefer_server_ciphers on;
   ssl_ciphers "EECDH+ECDSA+AESGCM EECDH+aRSA+AESGCM EECDH+ECDSA+SHA384 EECDH+ECDSA+SHA256 EECDH+aRSA+SHA384 EECDH+aRSA+SHA256 EECDH+aRSA+RC4 EECDH EDH+aRSA RC4 !aNULL !eNULL !LOW !3DES !MD5 !EXP !PSK !SRP !DSS";
   # reasonable SSL configuration, disable some known weak ciphers.

   location / {
     proxy_pass http://192.168.0.123:456;
     proxy_redirect http://192.168.0.123:456/ $scheme://$host:$server_port/;
 # If your webcam (or other proxied application) ever gives URLs in the HTTP headers
 # (e.g., in a 302 or 304 HTTP redirect),
 # the proxy_redirect line changes the URL in the HTTP header field
 # from http://192.168.0.123:456/some/path to https://192.168.0.1:8080/some/path
   }
}

Restart nginx, and now you should be able to connect to your webcam on your local network at https://192.168.0.101 (you'll get warnings about certificate being untrusted as it is a self-signed certificate).

Setup port forwarding in your router

The final step is to configure your router to do port forwarding.  That is when you connect to https://1.2.3.4 (port 443) from the outside world, set it up to port-forward to 192.168.0.101 (port 443).  Possibly set up dynamic DNS so if your home IP address changes it still points to the right place.  Some ISPs do block port 80 and 443, so you may have to change it to some other port.

Be careful about how you connect.  I've noticed many IP camera programs do not check certificates for trust (as they are often self-signed), so an attacker could possibly do a MitM attack by inserting a different self-signed certificate.  It's best if you add your self-signed certificate to be trusted on your own browsers and reject it if it changes.


Why is Multifactor Authentation Presented in Two Steps Instead of One When I use Google Authenticator two-factor authentication, Google will tell me if I get my password wrong before prompting me for an authentication code.

This goes against at least one intuitive line of reasoning -- it allows an attacker to check whether they have the right password before trying to attack two-factor authentication.

What are the trade-offs that make this a reasonable choice in Google's case, and in general? How should this inform similar questions in other spaces?

This question is about 2FA in general but Google is just a widely used example.

It prevents the attacker from knowing if you implement multifactor authentication, thus reducing the attack surface.

Edit: it also will allow you to be alerted if your password is compromised without allowing someone into your account. This will allow for user's who don't implement the security practice of unique passwords to resolve the issue before a breach occurs elsewhere.


Is it safe to use an encryption library (e.g., RNCryptor) instead of Keychain to store a user account password for an iOS app? I've been told that iOS Keychain has a bug where it sometimes returns null values. The dev who encountered this issue suggested rolling out our own password storage solution instead of using Keychain, so that we can bypass the bug. He was thinking of storing passwords encrypted with RNCryptor. Is this safe to do? More specifically, is it as safe as storing the passwords in Keychain? If so, where should it be stored, and what encryption password or key should be used?

Rule number one with crypto systems is don't re-invent the wheel.  Yes, you could implement a secure password store with RNCryptor, but you would need an expert to audit your code to make sure the proper protocol was followed.  That could get expensive.

If what you're seeing with the iOS keychain truly is a bug, it will likely be patched.  Check out these posts to see if they might be related to your problem:

https://stackoverflow.com/questions/10536859/ios-keychain-not-retrieving-values-from-background/10583042#10583042
https://forums.developer.apple.com/thread/26168


Onion routing vs crowds I have been studying about computer security and at some point i came across the terms of onion routing and crowds. From what i have understood they are very similar in their usage (interchangeable).

Is there any specific situation where anyone would want to use the one or the other better?

Crowds and Onion Routing are both used to create anonymous networks, but implemented in two different ways.

Onion Routing

Basic Operation

Anonymous networks like Tor rely on passing through multiple nodes with a layer of encryption added at each node.  This circuit is randomly predetermined when a node enters the network.  As the data passes through each node a layer is peeled off (like an onion) until the Exit Node.  At which the data sent is forwarded in the "clear1" to its destination.  As long as there are at least three nodes in the circuit taken to the destination no one node knows where the data originated and its destination at once.  This is how anonymity is achieved, but remember that Tor does not guarantee security.

Key Distribution

Tor uses its own protocol to negotiate symmetric keys for each hop.  This is done by requesting session keys from each of the hops in the circuit.  The nodes then respond with a session key encrypted using public key cryptography (I believe Tor uses Diffie Hellman).  With a key for each circuit node the data can now be encrypted.  It's encrypted with the last node's key first, and then layers the encryption backwards ending with a final layer of encryption with the first node's key.

Crowds

Basic Operation

With Crowds a user will join a crowd.  This is done using a client, Jondo (John Doe, get it!) on the user's machine.  To join a crowd you go through a server called a blender.  Here's an exerpt from the Wiki page:

  Each user joins a crowd of other users by registering himself at the
  blender which is a single server responsible for membership
  management. When a user registers, all the other members in the crowd
  are notified. The blender is also responsible for key distribution, as
  it distributes symmetric keys to individual pairs of jondos, used for
  encryption and decryption, respectively of packets routed along the
  virtual paths.

So once you're in the crowd you can make requests, and the request will randomly (uniform probability) choose a jondo to forward the request through.  At that point a coin flip (figuratively, probably equal to Pf > 0.5) is used to either forward to another random node, or forward to the destination.  In this sense the request gets mixed in with all other requests moving through the jondos.  Each node records the predecessor to create a tunnel from the source to the destination.  Due to the coin flip each node cannot tell if the message originated with its predecessor or not.

Key Distribution
According to the white paper (linked below):

  To make use of the blender (and thus the crowd), the user must
  establish an account with the blender, i.e., an account name and
  password that the blender stores.When the user starts a jondo, the
  jondo and the blender use this shared password to authenticate each
  other’s communication. As a result of that communication (and if the
  blender accepts the jondo into the crowd; see Section 8.2), the
  blender adds the new jondo (i.e., its IP address, port number, and
  account name) to its list of members, and reports this list back to
  the jondo. In addition, the blender generates and reports back a list
  of shared keys, each of which can be used to authenticate another
  member of the crowd. The blender then sends each key to the other
  jondo that is intended to share it (encrypted under the account
  password for that jondo) and informs the other jondo of the new
  member.

It also states that in a future version (unsure what is considered to be a future version at this point) that it will use Diffie Hellman for key distribution.

  We anticipate that in future versions of Crowds, jondos will establish
  shared keys using Diffie-Hellman key exchange [Diffie and Hellman
  1976], where the blender serves only to distribute the Diffie-Hellman
  public keys of crowd members. This will eliminate the present reliance
  on the blender for key generation.

Differences

The difference here is that with Crowds each pair of nodes has a different symmetric key used to encrypt the data between nodes.  A path key is established for each path that will encrypt the actual request and response.  This is forwarded along the path by using the symmetric key of each pair of nodes.  But there is no layering here.  With the randomness of Crowds you wouldn't want to encrypt the data 10 times.  The latency could grow out of control.

Also, Tor does not require an account to establish an initial connection to the network.  Now once Crowds begins using DH this account might no longer be necessary, and anonymous2 connections to a crowd could be possible.

The other main difference is how circuits are chosen.  While Tor relies on choosing a circuit of 3 Crowds relies on randomness to determine how many nodes are taken.  It could be 2, 3, or 15.  Depends on that coin flip.

As far as use cases, they're both anonymous technologies.  In that sense they're interchangeable, but they are very different implementations of anonymous networks.  I think it's more a preference as to which one you choose to use.  Obviously having to create an account to use the Crowds service might be a disadvantage, but perhaps you like randomness of its circuits more.  Either one will be suitable for the purpose it just depends on your comfort level, and what you prefer in the end.

Details on each Protocol

Crowds white paper (PDF)
Tor white paper (PDF)

1 Clear is defined as how the data was originally sent from the source.  If this data was encrypted then its not technically plaintext, but there is no added encryption by Onion Routing to data passed through the circuit.

2 By anonymous I mean no account that could possibly link a user to a specific crowd.


Testing http authentication via netcat I'm currently trying to track down what I think is a false positive from Nessus, my attempts to netcat into the device are failing, but I believe the service is shut off anyway and Nessus is being Nessus.

This brought up a question I've had for a while and any time I look it up on Google, I get 9001 answers to different things... How do vuln scanners authenticate to web services using either bash or cmd. I know it can be done with netcat or ncat, but I can't seem to find proper results. How is it done?

edit: forgot to mention this is http.

If you want to test a protocol with netcat, then you need to manually send everything that a normal client would send. For HTTP, it would look something like this:

GET / HTTP/1.1
Host: example.com
Authorization: Basic QWxhZGluOnNlc2FtIG9wZW4=
User-Agent: Some call me... Tim

Of course, you'd have to change all the fields to reflect what you'd want to send. You're better off using a tool that actually knows how to speak HTTP.

I'm partial to perl's lwp-request package, which most people know as simply the GET and POST commands. It would look something like this:

  GET -USse -C someuser:somepass  http://example.com/

See the man page for options, but -U=Request headers, -S=Status chain, -s=Status code, -e=response headers, -C=credentials

It's simple, capable, and flexible.

curl is also a very popular package for doing this sort of thing and can match the lwp-request functionality pretty much point-for-point and then some, but it's more complex. Same goes for wget, another popular option.


How secure is it to use ODBC Driver with SSL When Connecting from clients (such as Windows) to remote databases such as (MS-SQL Server), it is usually advised that this connection be via a service that runs on the database server.

It is possible to establish such connection without a service using ODBC driver. Some ODBC drivers offer SSL. I assume this method would require opening a port on the database server.

My questions are:

Would connection client to a remote database using SSL could be considered "as secure" as connecting via a service?
Is it less secure only because of the port opening requirement?
Is there a way to make ODBC connection a good solution from security perspective?

Note: I understand that words like good, secure, etc. are relative and somewhat vague, however, I am limited to the vocabulary I know.

Thanks.

If you are connecting to a service on database-server, that service also needs to listen to a port.
Not using an ODBC driver depends on the application at client-side. ODBC is intended to allow several applications (like e.g Word) to make connection to a database.

Opening ports of course should be limited as much as possible, but sometimes ain't possible. The database in this case needs to be listening to a port, to allow incoming packets. As long as the software/service using that port are secure and stay often updated, you should be okay.

Besides that, SSL is more secure that a standard connection.
This because SSL encrypts the connection. ODBC can be used with loads of protocols, including secure ones.

Did this answer your question?


Connecting Pendrive used by multiple users Tried looking for it but didn't find solution. So basically every once in a while we are getting from our kindergarten an USB pendrive with photos. I am trying to find a way to safely copy the files from there as this pendrive can be used by all parents from our group.
Thought about installing some Linux instance (dual boot, currently have only Windows installed) and using it only for the photos. Would such setup be moderately safe assuming that noone from the group is explicitly trying to hack other parents?

Usually those people are not very tech-savy. Thus there is a high risk that their PCs might be infected and they might spread it unknowingly via attached USB flash drives.
When booting from a Linux Live CD and accessing the data there, the risk could get reduced as with a reboot, changes to the OS are gone and most malware is written for other operating systems. There are things like bad usb and usb killer, though.
This risk could be mitigated for example with a dedicated, encrypted flash drive (e.g. Kingston Data Locker+) that are not as easily forgeable to a bad usb device as the generic dollar tree thumb drive. Non-tech people might have difficulties to operate an encrypted USB stick. But it would also educate them how to protect personal data against theft or loosing the flash drive.
However, I would not accept USB flash media from people that I know that they are not following basic security precautions.
The perfect medium for this is a CD/DVD without autorun. Albeit a bit vintage and can be read by anyone that gets access to it.


Is hacking back a valid security technique for companies? Recently it has come to light through the reverse engineering of hacking tools that there are vulnerabilities in them that could be exploited to take over an attackers computer during a remote hacking session. In other words, while they are hacking you, you could get into the system from which they are launching the attack to find out what they have managed to access, what the system is, or even p4wn it yourself. The goals would be damage control, deterrence, and ultimately being able to charge the perpetrator of the crime.

Leaving aside the many legal, ethical, and moral considerations (if you are curious there's a debate recorded here), my question is whether hacking back using this technique has any value to a company. If it was ethical and legal would it be worth a company to invest in the systems and skills needed to make this work, or is it a waste of money?

EDIT:
There's been several comments regarding leaving the legal and ethical considerations out of the question, so here's the explanation behind that. So far the discussion of hacking back in this manner has been discussed by lawyers, some shouting it is legal, and others saying it isn't. What they do agree on is that there's no case law, and until there is there will be no clear answer. Also, legalities vary from nation to nation, so the answer to legality is "maybe" and "it depends where you are".

However so far none of the discussion I've seen has been among IT Security professionals who would be the ones to design, deploy, and run systems that would to the hacking back. The lawyers all seem to think that organizations would adopt the technique as a matter of course, but I am not in agreement with that and I would like to hear the views of my peers. This is why I've asked the question apart from legal and ethical aspects.

We had this debate at our local OWASP chapter last night about whether a honeypot should strike back.  We did talk about some legal and moral issues however decided it was not a good idea because:

The majority of attacks are coming from dumb clients on botnets or through automated tools, so what are you actually achieving by taking out yet-another-dumb client?
The focus of your business should be aligned to your business objectives - fighting cybercrime (unless you work for a police authority) should not form part of that.
If the attack becomes serious and you need to go to court; evidence that you "struck back" would not look good and could work against you.  If you are going to spend money in this topic then spend it on forensic tools so that it strengthens any legal action
Circular attacks:  consider if you accidentally strike back at another tool that has strike back capability?  then you're just eating up bandwidth unnecessarily.


Why include a private key in a root certificate? In the recent Dell root certificate issue (see https://threatpost.com/dell-computers-ship-with-root-cert-private-key/115455/), the private key was included with the certificate.    This is baffling to me, and I have trouble believing such an "error" could be made in a structured development environment.

Is there any valid reason to include a private key in a root certificate?

You need the private key of a CA certificate if you want to sign another certificate. This is the case with SSL interception proxies like various Antivirus products provide and also the infamous Superfish ad-injecting software.

The main problem is if the private key is easily retrievable by an attacker so it can be used (together with the certificate) inside a man in the middle attack. This is typically the case if the same certificate and key is used on multiple installations of the same software, as done by Superfish. SSL intercepting Antivirus products instead create a unique certificate and key for each installation and thus are not affected that much by the problem.

You also need the private key if the certificate should be used for client authentication, i.e. if the computer should identity itself in a secure way within TLS/HTTPS connections. But in this case you usually only have a leaf certificate which can not be used to issue new certificates. Contrary to that the certificates used in the Superfish and eDellRoot certificate are CA certificates, i.e. can be used to issue new certificates and thus can be used for man in the middle attacks.


How effective is iPhone 3GS and 4 device-at-rest encryption? My primary goal is to protect Activesync-based communication from being copied or stolen from an offline device.

In that context how effective is iPhone 3GS and 4 encryption?

If you write the application, then you have various options for protecting the files stored on the device. I gave a presentation on this at Voices That Matter this year, but to summarise:

NSFileProtection API lets you use the same device key as the filesystem encryption, but ensure that the files are protected when the device is locked by additionally deriving a second key from the user's passcode;
CommonCrypto and OpenSSL are a bit harder to use, but still fairly straightforward, you control the encryption and can use the keychain for key management;
writing your own encryption implementation would be a bad choice.


Is JavaScript object injection exploitable? I'm testing a site that behaves like this:

When I change my username, I submit a POST request with JSON data like this {"username":"John"}.
If I change that to for example {"username":{"test":"test"}}, my username is printed like this: [object Object]
Therefore I concluded that I can inject objects and have tried to override the toString method of my object doing this: {"username":{"test":"test","toString":"function() {return 1;}"}}, but when I load a page where the username should be printed, I just get a runtime error in the console saying that toString is not a function.

I assume that I have successfully managed to overwrite the toString method, but it seems that I have just replaced it with a string, and therefore it is not a method anymore and cannot be executed.

Any ideas if this could be exploitable?

JSON can not be used for object injection in JavaScript the way your question suggests.

JSON only allows strings, numbers, objects, arrays, booleans and null. It does not allow functions. So what you are passing there might look like a function, but it is not one. It is just a string that happends to contain some code for a function. Unless there is something on the server explicitly taking strings and executing them as code (e.g. eval), the code will not be executed. JSON deserialization does not execute code in strings.

So why the error message? When you ask JavaScript to treat a variable as a string (e.g. print it), it tries to convert it to a string if it is not already one. This is done by trying to call the member toString. But you have set it to be a string, not a function, so it can not be called. Hence the error.


Execute Shellcode embedded into a picture? Somebody told me it is possible to insert shellcode into an image or pdf file and execute the shellcode if the image or pdf file was opened. I know that this could be possible if the application (for example Adobe Reader) is vulnerable to a buffer overflow. But is it possible to 'backdoor' a file without some special exploit, or are non-PE files safe?

There was an actual exploit that did this.

The problem isn't the image. It's the implementation of the application that reads the image data.

https://imagetragick.com/ - this is a great example of an application that read an image format, and executed code in that image.

But in general, no. Embedding shell code into an image should never allow execution of the shell code.


How to create a secure embeddable HTML form? I have an https website and I want to let other websites embed one of the pages on my website that lets users of my service log in and submit a form, similar to Paypal's payment iframe or Plaid's Link. Many such services exist, and from what I have found they all seem to be using iframes. Of course, I have heard of vulnerabilities with iframes, such as clickjacking, which make me think twice about having a user enter their login credentials and submit a form within an iframe.
But there's lots of companies that are using iframes to provide embeddable components or widgets for other domains to use, and presumably these are secure enough. So is it safe for me to enable iframing (X_FRAME_OPTIONS) for this page on my website, or is there another way? Are clickjacking, keyjacking, and other such attacks a real threat for this use case, and if so what can I do to mitigate these dangers?

There's no really good way to do this. The problem is less clickjacking - though that is a risk - and more that the user has no way to know whether the frame is genuine, or a phishing site. Anybody who wants to can put up an iframe that looks like yours, and just steals the user's credentials for your site if anybody thinks that this might be a real instance of your login page and enters them. To avoid that risk, you shouldn't ever lead your users to expect it's safe to enter their credentials on any third-party site!
The only way to get around that is to use a pop-up, a new window (tab, on modern browsers), or a top-level navigation (in all cases, to a login page on your domain). You'll notice that PayPal does this when signing in; they're not the only one.