Can this text be figured out? It seems that as long as a computer is connected to the network, any encryption used by that computer makes it insecure, because the computer can be compromised.

I wonder if in this scenario is it secure? And if it's not, how can it be more secure?

We have 2 users: Bob and Eve, both shares a secret key.

each have 1 computer connected to the network and 1 Android phone not connected to the network.

Bob uses his non connected Android device To encrypt a text file, and puts it in an SD card.

He uses his computer to read from the SD card, converts the generated cipher text in data matrix blocks, and sends them to Eve's computer.

Eve's opens the file, converts the data blocks into cipher text, then via OCR in the Android reads it and decrypts it.

Is it possible to get the secret key in this scenario and figure out what is in the text? If so, how?

Your story is unclear, so I assume a few things:

Alice has an Android device and a computer and Bob has an Android device and a computer. (You said "both have 2", but you mean both have 1 so in total there are 2: one for each person.)
The computers are compromised, but the Android devices are not.
The text file to be encrypted and sent was typed on the Android device.
All devices are contained in separate SCIFs. Communication between the computers goes via a cable and optionally any number of routers or other relays.
The Android device cannot be exploited via the SD Card (e.g. it doesn't run any autorun files, the user does not accidentally run an executable file from it, etc.).
Authenticated encryption is used.

Now to answer your question: yes, in this scenario it's secure, because you circumvented the whole problem.

The point of "you cannot do secure crypto on a compromised computer" is that you do crypto on a compromised computer. In this scenario your Android device does the crypto part, not the computer. Assuming it is not and cannot be compromised, of course it's secure. The computers only act like relays, just like any router on the Internet would when you send an encrypted message.


Security risks of allowing customer to use his own domain for a hosted SaaS application As a SaaS hosting, we are considering allowing customer to use an alternative domain to access his SaaS environment.

Default domain owned and hosted by us:

customersubdomain.ourdomain.com

Additionally we could add bindings for any domain to the same site, allowing an alternative domain, not owned by us:

www.customerdomain.com

Are there any security risks of doing this?

No, if the application is used solely by the customer, or any third party trust the application because they trust your customer. (not you)

For example: A administration panel, a web site that is under the customer's solely Control, a shopping page for customers etc.

Yes, if the application provides value to a third-party, and this third-party should not need to trust the customer.
For example if a user select to trust this SaaS application without implication of which customer it is.
Another example is a credit card entry form by a PCI DSS compliant aquirer. If the aquirer allows the customer to set his own domain on the CC form, then the customer's DNS server must be protected on the PCI DSS level, since if this are modified, the domain can be aimed on a CC collecting malicious site.

One example of this is that you provide antivirus scanning, and then you sell this "without brand name" to a customer, which can put his own name on the antivirus solution.
If the customer trust this solution because the Engine come from you, then your customer can turn malicious and aim the SaaS domain on a malicious site at any time.


TCP- or UDP-based Port Scans, IP Fragmented Packet Is this normal or is someone trying to hack/attack me? How can I stop this? My router is a Cg3000v2 netgear provided to me by Optus.

[TCP- or UDP-based Port Scan]411
Wed Aug 26 00:28:08 2015
27.253.92.28:59553
199.85.126.20:53
[IP Fragmented Packet]
1
Wed Aug 26 00:32:18 2015
27.253.92.28:32618
66.49.150.89:10332
[TCP- or UDP-based Port Scan]
245
Wed Aug 26 18:54:10 2015
27.253.92.28:57333
199.85.126.20:53

IP Fragmented Packets are a form of evasion against network devices. It consists of submitting the payload through smaller pieces to make it more difficult for firewalls and IPS to identify the scan or even an attack.

Networking scanning is pretty normal and you have to get prepared to it. Important is to have a firewall well configured in place, limit the open ports and have the services listening to them (ports) well hardened.


DDoS Protection for DNS providers Zerigo, our DNS provider has reported to have been under heavy DDOS attack in the last 24 hours or so. Considering the distributed nature of DNS, and their architecture consisting of 5 main DNS servers we didn't experience a direct DNS resolution problem (That said, we also have our own secondary DNS outside zerigo). However, we couldn't issue any DNS change and have it propagate.

It's hard to complain to a DNS (or any other) provider, when they are being attacked and it's clearly not their fault. However, the end result is that we, as customers, are affected.

As things go these days, DDOS is probably a question of when, not if. And DNS is a major potential point-of-failure for almost any internet-based company.

What measures could be recommended to such providers to best deal with a DDOS? and how can we, as customers, evaluate whether measures were effectively adopted by the provider so we can make a more informed decision about our choice of a DNS provider?

What measures could be recommended to such providers

It's situational, it depends on the existing server and network infrastructure, and what magnitude of DDoS attack they're looking to protect against.

Existing DNS providers have publicized some of their solutions:

easyDNS suffered major DDoS attacks in 2005, and have since blogged about what they have done to become more resilient against DDoS. Their solution includes using Anycast'ed DNS clusters, and connectivity from providers like Prolexic who provide DDoS mitigation services. Their blog post is worth a read, and includes tips on how customers can help themselves.

Amazon Route 53 also uses Anycast, and serves DNS from 30+ locations world wide. The sheer size of their infrastructure helps.

Additionally, Amazon Route 53 is intentionally built with a large address space for their infrastructure. For example a name server lookup for a Route 53 customer might look like this:

ns-154.awsdns-19.com.
ns-997.awsdns-60.net.
ns-1334.awsdns-38.org.
ns-1660.awsdns-15.co.uk.

AFAIK each of the above name server names points to an Anycast'ed server cluster. This may help to contain simpler attacks to a subset of Amazon's customers, and gives Amazon more options to mitigate an attack.

  evaluate whether measures were effectively adopted by the provider

That's a good question. Enterprise providers like UltraDNS (Neustar) are presumably willing to provide NDA's and then discuss specifics of their implementation. But realistically, most less expensive providers aren't going to spend lots of time explaining their infrastructure to you. You can read their blogs, and maybe ask them a few relevant pre-sales questions about DDoS mitigation via email, but that's about it.

For smaller Internet based companies, who don't have lots of resources for DNS, a reasonable plan might be:

Given that pure DNS hosting can be had for a few bucks per month, use two DNS providers together to be resilient against a provider failure. (NB: If you need proprietary features like Route 53's latency based routing, then this isn't possible.)
Prefer DNS providers who have publicly confirmed having DDoS mitigation planning, for example by blogging about it, or who answer reasonably to presales emails on the subject.


How does SSH public key auth link a public key to a login? I've generated a pair of keys with PuttyGen and I use it to connect to a remote server with Putty and SSH.

What surprises me is that, when configuring the public key authentication, at no moment I had to provide a login. The only moment I had to do that is when I had to log in the server to update the file .ssh/authorized_keys. But that log-in could have been done with any user that has the right to update that file.

I've checked the content of the public/private keys and the file authorized_keys, I've seen no info about the login.

When I log in, the login is asked then directly the server seems to look for a public key linked to that login. Where does it look for that link ?

The "public key - login" link is inferred from the place where the public key is stored:
it is added to the .ssh/authorized_keys on the server inside a specific user's home directory.

In a typical use case each account has a separate authorized_keys file. If it doesn't exist, you cannot connect to that account with an SSH key-based authorisation.

SSH client provides the account name you want to login to (on Unix-based systems the ssh command executed without account name will request login to the account name currently used on the connecting machine).

SSH server receives that account name and tries to match one of the keys in the authorized_keys file inside the home directory of the provided account.

SSH server also checks permissions to that file and denies login attempt if any user other than the owner could modify it.

In a less typical case a global authorized_keys may be configured. Then the file contains %u token for username (refer to man pages).


Why is Sojdlg123aljg a common password? I was going through the list of top 100K passwords and found Sojdlg123aljg near the top of the list. Does anyone have any idea why this is such a common password?

One of the most logical explanations is that those accounts were associated with a bot. Same goes for password like 18atcskd2w.

Graham Cluley  wrote an article about this: So, Just Why Is 18atcskd2w Such a Popular Password?

  Can so many people really be choosing to protect their online accounts
  with the same, seemingly random choice of “18atcskd2w”, “3rjs1la7qe,”
  or “q0tsrbv488”?

  The answer, of course, is no. People are not choosing those passwords.

  Yes, those credentials can be found amongst the stolen data, and those
  passwords are being used on many tens of thousands of accounts, but it
  wasn’t a human being who chose that password. It was a computer.

  Human brains were responsible for choosing passwords like “123456”,
  “password,” and “qwerty.” But there is no way that 91,103 people
  independently chose to secure their accounts with “18atcskd2w.”

  Instead, what I believe happened is that these accounts were created
  by bots, perhaps with the intention of posting spam onto the forums.

Edit:

Ok, I went to check some of records ("dumps") from breached websites:

ilerrhyc@qgjkwntm.com:18atcskD2W
lprfzoyj@aboriaqk.com:18atcskD2W
ytjcvfhx@erbnxkjx.com:18atcskD2W
imuudluz@qsldpvlx.com:18atcskD2W
rrrowvvn@gdcufxsg.com:18atcskD2W
kixtigma@snjkuxjh.com:18atcskD2W

I'm pretty sure that those passwords were associated with bot, but funny thing is that attacker used random username with random-non-existing domain, but non-random password.


If the stack grows downwards, how can a buffer overflow overwrite content above the variable? I realize how a buffer overflow works but I have a problem understanding the direction in which the overflow is directed. So if the stack grows downwards, that means that the return address is above the variable's reserved space. When that variable is now overflowed, shouldn't it overwrite memory below instead of above?

tl;dr: If the stack grows downwards, how can a buffer overflow overwrite content above the variable?

If the stack grows downward, functions that are called later get stack frames at lower memory addresses. Also, the return address is pushed to the stack before space for local variables is reserved, so the return address gets a higher address than the local variables. But arrays and buffers are still indexed upwards in memory, so writing past the end of the array will nicely hit the return address next on the stack.

Example, with mandatory ASCII art:

Consider the trivial function that takes input from an untrusted source, and copies it to a local buffer:

void foo(char *s)
{
    char buf[8];
    strcpy(buf, s);
    return;
}

The stack looks a bit like this:

   <---- stack grows to the left
    memory addresses increase to the right -->
  0x8000                        0x8010
  +--------+----------+---------++------------
  + buf[8] | ret addr | char *s ||   .......
  +--------+----------+---------++--------------
   <--------- foo() ----------->  <---- caller --

The stack is filled from right to left, starting with the function arguments, then the return address, then the locals of the function. It's easy to see that a simple overflow from buf towards increasing addresses will hit the return address nicely.

So, what if the stack is inverted, and it grows upwards? Then overflowing a buffer will run the same way the stack grows, towards the empty part of the stack.

Sounds nice, but it doesn't help if foo() calls another function to do the copy. Which isn't unusual, I just did that with the strcpy. Now the stack looks like this:

    stack grows to the right -->
    memory addresses increase to the right -->
            0x8000                          0x8010
------------++---------+----------+---------++-----------+-------------+
  ....      || char *s | ret addr | buf[8]  || ret addr  | locals  ... |
------------++---------+----------+---------++-----------+-------------+
 caller --->  <-------- foo() ------------->  <---- strcpy() ---------->

Now, overrunning (to the right) the buffer in foo()'s stack frame will nicely overwrite the return address of strcpy(), not foo(). Doesn't matter, though, we still jump to a location set by the overflowing, attacker-controlled data.


How does the ipv4 option "record route" work? As written in the RFC 791 this option is useful to record the addresses of the routers that an ip datagram goes through.

I'm sending an ip datagram with an ICMP echo message, i've set the option type (of the header ip) on 7, the option length on 7 and the pointer on 4.

I expect an echo reply with the first router address to come back, but this doesn't happends. Am i doing something wrong or the option is not supported anymore?(If i don't set the options, the echo response comes back as expect)

It is not uncommon for this option to be blocked by ISPs.  Since you are getting no route information at all, the router closest to you (i.e. your home or office router) is probably black-holing those packets.  If you can reconfigure that device, you may well find that you can get little or no more information from downstream for the same reason.


Why were CBC_SHA256 ciphersuites like TLS_RSA_WITH_AES_128_CBC_SHA256 defined? It is my understanding that:

In TLS, the hash function is used only in HMAC construct.
SHA-1 is secure when used in HMAC.
TLS 1.2 switched the PRF used to derive the symmetric keys to no weaker than SHA-2, regardless of ciphersuite, thus in TLS 1.2 the hash function named in the ciphersuite is used only for HMAC during bulk data transfer.
TLS_RSA_WITH_AES_128_CBC_SHA256 seems no more secure than TLS_RSA_WITH_AES_128_CBC_SHA, but has more bandwidth overhead (extra 12 bytes each record, which may be up to 16KB long).

Is the above correct? What was the rationale for defining the CBC SHA-2 ciphersuites in TLS 1.2? Was it a hedge against HMAC_SHA1 getting catastrophically broken but in such a way that leaves HMAC_SHA256 intact?

If my analysis is correct, does it mean that there is no point in supporting TLS_RSA_WITH_AES_128_CBC_SHA256? Is this the reasoning behind Android 5 and golang not supporting CBC_SHA256?

Note: I know about PFS and AEAD, this is a question about the merits of CBC_SHA256 vs. CBC_SHA.

I've read the history of the work on this part of the TLS specification.

Eric Rescorla (co-editor of TLS 1.1, 1.2 and 1.3) posted on Dec 31st, 2007 on IETF TLS working group mailing list about a work item called "Issue 66: HMAC-256 based ciphersuites" for the next draft of TLS 1.2 (then called RFC4346-bis, i.e. a revision of TLS 1.1, now known as RFC 5246).

The originator of the idea is unknown.

The reason to add the new cipher suites is because it's weird for TLS 1.2 to switch the PRF to SHA-256 and then not allow SHA-256 for the bulk encryption authentication.

The idea was supported by Uri Blumenthal (MIT Lincoln Lab) saying SHA-1 has weaknesses and there is no need to wait for it to be broken before replacements are defined.

Nikos Mavrogiannopoulos (author of GnuTLS) supported the idea to match the cryptographic strength of the primitives (especially of AES-256).

Pasi Eronen (Nokia, lots of work on EAP) suggested the names of some of the new cipher suites.

Then there was some talk about the right size of hash function to match to each cipher between MIURA Fumiaki (Nippon Telegraph and Telephone), Florian Weimer (BFK, Red Hat, recently worked on fixing Shellshock), Ken Peirce who suggested to use NIST "bits of security" metric the solve the dilemma, Jeffrey A. Williams and Bodo Möller (recently worked on fixing Heartbleed) who provided links and explanation that "128-bit MAC security should be perfectly fine even for applications requiring 256-bit encryption security".

The TLS spec was updated (presumably by Eric Rescorla) with the new cipher suites and published in draft 8 which was out on Jan 25th, 2008.

The draft 8 change log reads, in part: "Added support for SHA256 cipher suites", no rationale.

In the final version of the specification, in the list of changes since TLS 1.1, says "Added HMAC-SHA256 cipher suites", again, no rationale. The cipher suite list in appendix C remained unchanged since draft 8.


How risky would it be to run a Linux kernel without Spectre and Meltdown patches on a regular desktop system? What would happen if we adopted: https://make-linux-fast-again.com/

Assume the system is used for development and general browsing.

Are there any cases of these vulnerabilities being exploited in the wild, (especially by websites)?

Simply put: You would undo a lot of mitigations.

Whenever a vulnerability like Spectre or Meltdown comes along, people run to see who should deploy the patch. Browser vendors (quite rightfully so), claim that fixing CPU bugs is not something they are responsible for. It would make sense to patch it on an OS level, as that would mean not every application would have to take care of it themselves.

As a result, if you would disable all these mitigations, you become potentially vulnerable to those attacks.

How unsafe would this make you?

Depending on your desired level of paranoia, ranging from "Not at all" to "They've probably overtaken my CPU already". To answer more seriously, it is entirely possible to exploit this using JavaScript. It is difficult to say if this has been exploited in the wild, and if so, if it was successful. I personally would say it's not on the top of my threat list, but I also would not want to intentionally disable security features.

So the answer is basically the same as with disabling any other security features: Proceed at your own risk.


Secure MySQL data on hosted 3rd part server I have an application that stores sensitive PII and financial data, and is hosted on a 3rd party server (typical web host). Anything sensitive is encrypted as it goes into the database, and I have no issue with the security of the hosting provider or the server configuration.

However as the application necessarily needs the encryption key to operate on the data, that key must be stored on the same host as the data. Although protected from public access, the question has been asked about rogue insider or 'hacker' at the host end who would presumably be able to access the key.

Is there any way to protect against this type of attack, or must we simply trust the hosting provider?

(For purposes of this question, lets ignore application layer risks such as injection attacks. We do what we can to prevent these, but obviously there is always some risk where the application is dealing with the decrypted data.)

The question is where does the encryption/decryption take place. If they are run on the third party server then there are no means you can protect the key as how and where it is being stored and how it is being used depends solely on the policies of the provider.

There is some literature on the topic and there are approaches that use a key directory to store the keys which can reside either at the provider or on a trusted third party, and upon encryption/decryption keys are being exchanged by the db provider and the trusted third party by using a master key.

The granularity of the encryption can also be specified(the encryption can be done at database, table, partition or low level. A paper that highlights the workings of such a mechanism can be found here.


Does asymmetric encryption guarantee data integrity? I have some unusual size constraints for my data which may be relevant to the prescribed solution.

The scenario is as follows. Secure server A generates 240 bytes of data that need to be consumed by an offline client B. Client B needs to ensure that the 240 byte message was not altered. I tend to stumble ingloriously over the semantics and terminology of the security world, but I believe what I am looking for is 'data integrity'.

If I follow this process does it guarantee 'data integrity'? (I realize guarantee might be a strong word)

Generate a public/private key pair on the server A
Perform an asymmetric encrypt on the 240 byte message using the private key (a signing operation if I understand properly)
Client B is issued the public key and the encrypted (signed) messsage

If Client B is successful in decrypting the message does this guarantee, at least academically, that the data has not been altered with?

Note 1: The number of bytes available on the transfer medium to Client B are at a premium, an increase of up to 40% increase due to the encryption could be tolerated, for example an RSA signature using a 2048-bit key resulting in 256 bytes from my 240 byte message would be acceptable.

Note 2: There is no expectation of privacy. I do not care if the data can be read by anyone. Only that the scheme can detect if the message has been tampered with.

Ancillary Question: Is there a recommended algorithm? I have been toying with RSA using 2048-bit keys.

Thank you security wizards, I don't know how you guys do it.

You're on the right track, what you want is to use a private/public key pair to create and verify signatures.

But first

Your understanding of signature algorithms is incorrect. You've been given the "standard" encrypt the hash of the data explanation and misinterpreted it.

First, the common explanation is that you encrypt a hash of the data, not the data itself. If you encrypt a hash of the data, then someone modifying the data won't know how to alter the encrypted hash so that it matches. If you encrypt the data itself there is nothing to provide integrity. An attacker can modify it however they want (however they won't be able to know the decrypted value they're changing it from or to).

Second, this all too common explanation is incorrect (see here for a better but lengthy explanation). This explanation only works for RSA, and it's not even really accurate for RSA. One of the operations performed to create an RSA signature is also used in RSA decryption, so it'd be more accurate to say that an RSA signature is the decryption of the hash of the data, but then you're decrypting something which was never encrypted to begin with, which is even more confusing, and that still doesn't account for the different padding required for signatures and encryption.

Now the answer

A signature is definitely what you're looking for, but RSA signatures are large (256 bytes for a 2048 bit key), so I'd recommend that you look into ECDSA, as the signatures are much smaller for a similar security level. According to that Wikipedia article, to have a 128 bit security level (very standard) your signature will be 512 bits, or 64 bytes, which seems acceptable. Just please, please find a library to do it for you, it's far too easy to screw these things up.


Port forwarding to ip address in LAN that is not available Consider the following situation:
In a LAN the router is configured to forward one incoming port from the WAN to a specific local ip-address/port.

My question is, how is the security in this situation impacted compared to a router, which does not perform port forwarding, when

the ip-address configured for forwarding is not used in the LAN
the ip-address configured for forwarding is available in the LAN, but no application is listening on the port

What are possible security risks/attack vectors for cases 1 and 2?

Risks? Almost none.

The expected responses are:

On case 1:

router returns Destination Unreachable message to the client
router ignores packet and let the connection time out on the client

On case 2:

Computer sends back a TCP RST and drops the connection
Computer ignores packet and let the connection time out

If you have a router without port forward, but with NAT, unless the internal service uses STUN, UPnP or another NAT traversal tool, they are essentially inaccessible. Packets will reach the router, which don't have that port open, and router resets the connection.

If you have a router without port forwarding and you have public IP addresses on all your computers, you will expose all of them to the Internet. Without a firewall protecting them, you are inviting trouble with big, bright neon billboards...


Is a short sudo password ok? On a server I control, I have disabled password logins (public key only), but still need to enter my password to access sudo. This is becoming cumbersome, as I use a long, automatically generated password. I find myself frequently having to copy/paste the password.

I gather that it's a Bad Idea to disable password checking for sudo (as it opens you to the threat of any script you run quietly sudoing in the background).

Would it therefore be reasonable to use a short, fairly weak password?

This particular system runs various (internet-accessible) web services, and can only be SSH'ed to through a gateway server (which is itself internet accessible).

You have already acknowledged that having no password is a bad idea due to the fact that your server can be accessible via the Internet. Without a sudo password, it means that you are relying on your public key authentication.

If a vulnerability would be found in the authentication which allows an attacker to login:

No sudo password

It means that your server would be compromised to a level where the attacker has total access. Obviously, this is no good.

Short password

Assuming that you don't quickly find out about the vulnerability, an attacker could attempt dictionary or brute-force attacks.

Conclusion

Having a decent-sized password would offer an extra layer of protection if your public key authentication would fail. As Stephen pointed out in the comment section, you mentioned that the server is also running web services. This means that users of the services are also relying on your security. The attacker could easily edit your files to spread some malwares with the password.

See this question for some thoughts about password length.


What is the difference between PCI-DSS compliance and certification? PCI-DSS compliance and certification appears to be used interchangeably however it isn't clear what the differences are.

For example if you are certified does it mean you are compliant and if you are compliant can you then apply for certification?

You are compliant if you follow all the rules of PCI-DSS that apply to your situation.

You are certified if an accredited independent auditor asserts, in his professional statute, that you are compliant to PCI-DSS.

If you apply for certification and the auditor finds out that you are not, in fact, compliant, then he will say so and point out the problems. It would still be up to you to fix the issues and try again.


How to determine if it is safe to install apk files from alternative android app stores? Several sites offer APK downloads (1, 2, 3). Is there a way to determine if a given website/apk is safe to install?

Initial Analysis

I think the most thorough way to test 3rd party apps is to:

Download the Android SDK/Tools
Create a virtual Android Device with the Android version of your phone.
Enable Android Debugging through USB on your device. (Can be turned off later)
Check with ADB that your emulator is detected: adb devices
Install the 3rd party app with ADB: `adb install

You can analyze what's going on in the device using different logs that are constantly running.  These can be tough to capture, but you can capture the logcat of your device with adb logcat.  You can learn how to use Logcat like a Pro.
The Android Virtual Device (AVD) uses your internet connection like a WiFi connection.  At this point you can perform all kinds of analysis.  My post on how to analyze malware could be helpful (as far as tools and techniques to use).  Wireshark will be a helpful tool to analyze network traffic.  See what the app with its networking connections.
Reverse Engineering

So now you'll be getting down and dirty into seeing what exactly the APK is doing.  For this you'll need a few tools.  Here is an online tool (I have not used it) that claims to decompile an Android APK back into its Java code.  If you would like to understand the process and do it yourself I would look at this Stack Overflow answer.
An APK is just a .zip file.  So the steps (with tools from that Stack Overflow answer)

unzip example.apk

Now we have the following files and directories:
-rw-rw-r--  1       3708 Oct 14  2013 AndroidManifest.xml
-rw-rw-r--  1    2751916 Oct 14  2013 classes.dex
drwxrwxr-x  2       4096 Aug  3 12:12 META-INF
drwxrwxr-x 23       4096 Aug  3 12:12 res
-rw-rw-r--  1     363640 Oct 14  2013 resources.arsc

The classes.dex is what we want.  It contains all the Java classes used for the application.

./d2j-dex2jar.sh ../example.apk

Now we have a ./example-dex2jar.jar JAR file that can be decompiled into Java code.  Here is where JD-GUI and ApkTool can be useful.  Now you can look at the exact code that is executed by the APK.
Keep in mind though that some portions (if not most) of the Java code will be obfuscated.  This is common and you'll often see function symbols ripped out and replaced with a, b, etc.  Not only functions, but packages, methods, variables.  Seeing obfuscated Java like z = (a) b.d() would not be uncommon.  But you can see strings, typical imports, and any JNI shared object functions they may use.

All that being said.  Do you want to do that for every app you download?  Probably not.  It comes down to whether you trust the Store that you're using, and/or the software company that put out the app.  I personally don't use any apps outside of the Google Play store.  The Apps I do download I base on companies that developed them, user reviews (these can be faked), friend/forum recommendations, etc.
You have to give some sort of trust to the app you're downloading, or analyze each and every app you install.  Either way you've got to use caution.


Do socks5 errors expose my real ip address when downloading torrents with qbittorrent on windows 10 and using a proxy? When downloading torrents with qbittorrent on windows 10 and using a proxy, I frequently get Socks5 error messages. They don't seem to affect the download. Is my real ip address exposed whenever these errors come up?

The simplest way to determine if your IP is exposed while torrenting is to use a tool to do just that.
You can find many sites that do this by googling "check torrent IP", but I use this one:
http://checkmyip.torrentprivacy.com/
After following the instruction on that site, it will show your exposed torrenting IP, allowing you to determine if it's the proxy's IP or your own.


What is the difference between a hash table and a rainbow table, and how are they both used? Is there much of a difference between the two tables? Can you get one from the other? (i.e. hash -> rainbow) How do they work? Are there different variables (in reference to speed, strength, resources, size, etc) that other things depend on? An in depth explanation of the two as well as a compare and contrast would be great and maybe a few examples/scenarios in which the two can be used.

Both hash tables and rainbow tables store precomputed hash values. Rainbow tables are a computing power vs storage tradeoff compared to hash tables.  They are used because hash tables can grow very large especially as the throughput of cracking hardware has improved. You can brute force more combinations but now you need to store more.

How much space are we talking about?  There are common password lists (taken from previous hacks) with tens of millions of known passwords and that is usually where crackers start.  This can be supplemented by hundreds of millions of permutations of those weak passwords (if someone used password1111 someone else probably used password2222). Then lastly for good measure the gaps can be filled in with an exhaustive search of all possible combinations of passwords up to a certain length.  Take 1 billion passwords, with an average length of 8 characters, and a 32 byte hash. That is 40GB of storage space to store the hash table.

A rainbow table is a way to store the same information using less space.  There is no free lunch though in computing you can always trade storage for computing power and that is what you are doing.  To build a rainbow table, a traditional hash table is first constructed.  Starting with those hash values a hash chain is constructed using alternating hashing and reduction functions.  The reduction function maps the hashes back to different passwords in the list.  The length of the chain is determines how much of a tradeoff is used (longer = more space saved but more work to perform a search).

Only the chain beginning and end are saved and the rest is discarded so the final table is much smaller.  Locating a match now required multiple lookups which means it takes longer than a hash table.

Both hash tables and rainbow tables are used to save the results of a precomputation attack.
Lookups in a rainbow table are slower*, but require less space to store the precomputed results of a given number of passwords.
Lookups in a hash table are faster*, but requires more space to store the precomputed results of a given number of passwords.
Both hash tables and rainbow tables are equally and totally defeated by using a pseudo-random salt per record.

*This assumes equal hardware response time which may not be the case (i.e. rainbow table can fit in main memory but hashtable requires a read from slower disk because it is too large to fit in main memory).


Why is disabling root necessary for security? This page on server hardening claims:

  Disabling the root account is necessary for security reasons.

Why is disabling the root account necessary for security reasons?

If you're not using Root, you're using sudo! Sudo is a great way to become root only when you need to.

Root is a giant target. What's root's username? Root! I'm so smart :)
Logging. Sudo has a greater command of audit logging (so that when someone uses sudo to do something silly, you can tattle on them to the central logging server). This is helpful for forensic analysis in some cases.
Granular permissions. Root is a Big Flippin' Hammer. Do not hand BFHs to your users. Sudo allows you to specify that a user can run update commands like aptitude without password, but everything is off limits! You can't do that with the BFH that is root. IT allows you the flexibility of sanctioning certain commands for users, but disallowing others. This allows you to build a security policy that does not require an administrator to physically log in to a machine every time a machine needs to be updated (or another menial task).
Idiot-proofing. Why do you not hand users a BFH? Because they're dumb. Why do I use sudo instead of root? I'm dumb. Dumb means mistakes, and mistakes mean security holes and sysadmin-issues.


Why is my IP address not my own? When I search the geographic location of my IP address why does it show multiple cities and states that are not my own?  Does this indicate someone else is sharing my IP address?

Unless you have been directly assigned a range of IP address from the regional internet registry (faka RIR), then you are using someone else's IP address.

The vast majority of the users on the internet are in this same situation.  Typically, you are using an IP address (or range of addresses) that has been assigned to their ISP and they are in turn allowing the customer to use.

Whether your IP address is shared with other users, whether it changes, or if you have a dedicated static IP are all details that are based on your ISP and the type of service for which you are paying them.

The most basic of IP geolocation services use the information of the registered entity to which the IP range has been assigned.  If you run a whois search at a RIR for a certain IP address or network, it should either return information on the entity or which other RIR you may need to check with to find the information.  As an example, if you did a whois for 8.8.8.8 (a widely known Google administered DNS server), you will find details about Google (address, contact info, etc).  In this basic type of geolocation service, this IP would be shown to be located in Mountain View, CA.

However geolocation often gets much more involved and the exact nature of the service will be dependent on the provider.  There a numerous entities that maintain databases of geolocation information based on many other pieces of information.  This may involve information from routing tables, information gathered from devices/apps with access to GPS information, etc.  It can also tie into more than just IP address such as wireless network names, wireless BSSIDs, cellular information, etc.

Just like with search engines, the way this data is gathered and used can vary the results depending on the service.  Some may be more accurate, or some may contain old or invalid data.

So, getting back to your questions:

  When I search the geographic location of my IP address why does it show multiple cities and states that are not my own? Does this indicate someone else is sharing my IP address?

The reason you may be getting multiple cities/states may be as you indicate that this IP address may be used by more than one customer at different points in time (or possibly the same time if the ISP is using NAT).  Or it could be that the website you are referencing is pulling data from multiple geolocation databases that may be providing different results with varying degrees of accuracy.

Ultimately, you need to understand that unlike TV/movies seem to often indicate, IP address are not fixed to geographic locations.  They are fixed to entities that decide how/where to use them and may change that usage over time as they need.  Unless you can tie into an ISP's systems to know to which customer is using a given IP at the moment, you won't have a high degree of certainty of the exact location in use.


Can someone explain the "Covert Redirect" vulnerability in OAuth and OpenID? CNet is reporting that all OpenID and OAuth sites are vulnerable to an attack called "Covert Redirect". What is this attack, how does it work, and as an end user, how can I mitigate the risk?

This isn't a vulnerability of/in OAuth 2.0 at all. The issue has been wildly overblown and misstated by CNET and the original finder.

Here it is in a nutshell:  If your web site (example.com) implements an open redirect endpoint - that is, implements a URL that will redirect the browser to any URL given in the URL parameters - AND your redirect copies URL parameters from the incoming URL to the outgoing redirect URL, then it is possible for third parties to exploit this artifact of your web site in a wide variety of nasty ways.

Worst case: evil.com is able to get the auth code originally intended for your web site (example.com) and may be able to use that auth code to extract user information from the auth provider (Google, Facebook, etc) or possibly even take control of the user's account on your web site.

Would evil.com be able to take control of the user's Google account using that access code? No, because the access code was minted for your site, example.com, and only works there.

Who's fault is it?  Yours, for implementing an open redirect on your site. Don't blame Google or Facebook or others for your poor implementation.

There are a few legitimate use cases for having a redirect on your site. The biggest one is to redirect the browser after login to the web page (on your site) that the user originally requested. This only needs to redirect from your web site to pages in your web site, on your domain.

How to fix it?  Have your redirect endpoint (example.com/redirect?&destination=ht.tp://foo.com...) validate the destination URL. Only allow redirects to pages on your site, in your domain.

More info on my blog: http://dannythorpe.com/2014/05/02/tech-analysis-of-serious-security-flaw-in-oauth-openid-discovered/

Update: There is an open redirect issue when using Facebook for OAuth user login. When you configure your app definition on Facebook, be sure to enter your domain-specific redirect URL in the redirect field provided. Facebook allows this field to be left blank. If left blank, Facebook itself acts as an open redirect while processing user logins for your web site.

Facebook should fix this by simply not allowing the redirect URL field to be left blank.


Does CryptoWall needs a internet connection to encrypt my files? Does CryptoWall 3.0 use some resource on the internet to encrypt my files?

I watched this video on YouTube - in this video a tool is used to sniff network traffic and find information about CryptoWall sending data to ransom server.

The ransom wrote that the private key is with them, so to crypt my files they need to send a hash or the file to them?

If I disconnect from the internet, will it stop the crypto process?

Short answer:

It will need internet connectivity briefly, then it will encrypt everything even if you disconnect.

Long answer

As soon as CryptoWall runs, it will generate a random RSA public and private keys, connect to one or more control servers, and upload the private key along with some information on the system it is, like OS version, public IP and location. Then it can run disconnected.

After generating the keys, the malware will proceed to encrypt every single file it supports. Some variants will keep the original intact during the encryption phase, and delete all original files after encrypting all of them. Some variants will encrypt and delete the original in one pass.

The server will keep the private key for some time, and you have to upload a sample of an encrypted file to them. They will send back the private key you will need to decrypt the files.

You probably have no chance of stopping the encryption process once it started. CryptoWall employs a number of defenses, and if you get caught by it, it's over. The encryption is well made too, so the chances of bruteforcing it is almost zero. Backups will not save you if your backup drive is connected to the PC all the time, as CryptoWall will encrypt your backups too.


Proper implementation of JWT authentication in mobile app I'm building a mobile app that connects to a Python Flask API and backend.

Currently, I am using JWTs for authentication. The expiration of the token is set to be 6 months in advance.

The thing that worries me is that that is a long time that the token is valid.

I've heard of people using short-lived tokens combined with a "refresh token".

I'm not sure how this works though.

So my question is:

What should I do to make this more secure? Should I use refresh tokens?
If refresh tokens are the best option, could someone either try to explain them to me so I have enough of an understanding to code my own implementation, or point me to some good resources where I could find such information?

Yes, 6 months is indeed a very long time because if the token gets stolen by an unauthorised third party, that party would be able to use the token for a very long time (unless detected). This is not very secure.

As you said, a slightly more secure way to do it is just as you mentioned - use refresh tokens. The way this works is that you’d have two tokens - a short-lived JWT access token and a long-lived Opaque refresh token. If the access token expires, then the refresh token can be used to get a new access token. This is more secure because even if the access token is stolen, it would expire soon. This minimizes the damage because the attacker has less time. However, what if the refresh token was stolen? In that case, unless detected, the attacker could continue to have unauthorised access to the victim’s account.

Now, how would you go about actually detecting the theft? It can be done by using what is known as ‘refreshing rotating tokens’ (see RFC 6819). However, the implementation details of that are non-trivial. If you want a quick explanation of the flow, check out my blogpost.


Online Government Elections System - Is it possible? I am from Bulgaria and currently some groups here are promoting the idea of referendum among the people, about the possibility for establishing a system for ONLINE GOVERNMENT ELECTIONS. The idea is that the people should be able to vote for elections using the internet.

One concern for me is that on the web site of the promoters, there are no details about how this system shall be managed, hosted and secured. I stumbled upon some documents in the internet, that show that such prototype systems have been successfully hacked so far and that this is a very insecure mechanism for elections. However the people insist that there is a way, that the system can be made secure enough, and that there are no problems.

Do you think that the implementation of such system is possible TODAY with the current technologies that we have - like modern Cryptographic algorithms, Digital Signatures, SSL or some proprietary protocols? Or in the future?

Isn't it possible for a government with high enough budget for super-computers to break, manipulate and compromise the system according to their wishes?

It is not known how to build an Internet voting system that will be verifiably secure and auditable.  Ron Rivest, Turing award winner and the R in RSA, has famously compared Internet voting to drunk driving: something you just can't do safely.
(By Internet voting, I mean voting over the Internet from client computers not controlled by election authorities, including return of voted ballots electronically over the Internet.)
The argument against Internet voting is a bit elaborate, but you can find details in the following articles:

If I can shop and bank online, why can’t I vote online?, David Jefferson.

A Security Analysis of the Secure Electronic Registration and Voting Experiment (SERVE), David Jefferson, Avi Rubin, Barbara Simons, and David Wagner.  Published in excerpted form in Communications of the ACM, volume 47, number 10, October 2004.

Attacking the Washington, D.C. Internet Voting System, Scott Wolchok, Eric Wustrow, Dawn Isabel, and J. Alex Halderman.  Published in FC 2012.

Don't miss the last paper.  It is a totally epic hack of an Internet voting system.


Does the carrier network autheticates itself to the SIM card? From my understanding this is how SIM authentication works:

When the mobile device starts up it obtains IMSI from the SIM card and send it to the operator network
Operator network finds the Ki(128 bit symmetric auth key) of the given IMSI generates RAND(a radnom number) and encrypts the RAND with Ki and that gives the value RAND_1, and also sends RAND to the mobile device which forwards it to the SIM card
SIM card receives RAND and encrypt it using Ki and calculates RAND_2 and sends it trough mobile device to operator network
Operator network compares RAND_1 and RAND_2 and if they are equal the SIM is succesfully authenticated to the network

So, that's how the SIM authenticates itself to the network. But, how does the network prooves it's identity. Someone could easily set up their own tower and act like the operator network?

According to these slides, during the handshake both the operator and the SIM card uses A8, RAND, and Ki to generate a session key (Kc).

After the operator compares RAND_1 and RAND_2, it uses Kc to encrypt a message. The mobile then tries to decrypt the encrypted message with Kc; if this decryption is successful, then the mobile had, in effect, authenticated that the operator of the tower knows Ki as well, because generating Kc requires knowing Ki.


Are there Secure Coding Standards other that CERT? I am familiar with the CERT Secure Coding Standart. Are there also any other secure coding standarts other than the CERT ones?

I'm aware of two:

The OWASP Developer Guide (to go along with the OWASP Top 10).
David A. Wheeler's Secure Programming HOWTO, which is a very long and very comprehensive guide.


How likely is it that the Hot Potato vulnerability can be exploited on a up-to-date Windows 2012 machine? I recently found an article about the Hot Potato vulnerability and it seemed quite interesting.

  Using this technique, we can elevate our privilege on a Windows workstation from the lowest levels to “NT AUTHORITY\SYSTEM” – the highest level of privilege available on a Windows machine.

The exploit basically consists of three aspects:

Local NBNS Spoofer
Fake WPAD Proxy Server
HTTP -> SMB NTLM Relay

I'm specifically interested in this vulnerability on Windows Server 2012 (R2). The exploit makes use of an automatic update mechanism that downloads certificate trust lists (CTLs) on a daily basis.

  The researchers said that using SMB (Server Message Block) signing may theoretically block the attack. Other method to stop the NTNL relay attack is by enabling “Extended Protection for Authentication” in Windows.

My question, are one of the two mitigations as suggested by the researchers automatically used as a patch/fix through Windows Update, since the initial vulnerability was released? I think somewhere in the beginning of 2016.

Note: It's ironic that the introduction of a daily update of CTLs that are meant to improve security, introduce a massive Privilege Escalation vulnerability.

No, SMB signing and/or EPA must be changed at the policy level -- either local policy and/or Group Policy. There is no patch that properly covers all NTLM relay attacks. The other worry is JASBUG, which requires SMB signing and/or EPA along with a UNC Path Hardening policy.

See -- https://security.stackexchange.com/a/139578/140 -- for more information on both


Why is there not a SameOrigin flag that you can put on cookies to prevent CSRF? Today, I was going through the process of making sure my server is protected against CSRF attacks, and I was wondering why there is not just a SameOrigin flag that I can set on my Cookies.  In much the same way that you can set HTTPOnly or Secure on cookies, I think there should be a SameOrigin flag which would only send the cookie if the browser was currently on the same website as what the cookie was set on.

Wouldn't this be an elegant solution to solving CSRF attacks?  You could also implement it in a backwards compatible way where cookies that don't have SameOrigin set are just treated the way that cookies have always behaved.

It is a good idea, and as @paj28 pointed out in the comments, there is already an RFC draft for SameSite cookies.
One downside that is mentioned in the draft:

Consider the scenario in which a user reads their email at MegaCorp Inc's webmail provider "https://example.com/".  They might expect that clicking on an emailed link to "https://projects.com/secret/project" would show them the secret project that they're authorized to see, but if "projects.com" has marked their session cookies as "SameSite", then this cross-site navigation won't send them along with the request. "projects.com" will render a 404 error to avoid leaking secret information, and the user will be quite confused.

Basically, a strict SameOrigin cookie would break links to backend components.
The draft also proposes a lenient mode which would send cookies on GET requests across sites, but it is a common problem that many applications do not follow restful, but instead have GET requests that change server state.
Another problem is that applications will still need to implement their own CSRF protection for all those users not using up-to-date cookies, so the extra development costs of correctly configuring SameOrigin cookies may not be worth it for some developers.


How can I prevent my son accessing my PC? Possible Duplicate:
  How can I prevent my kids from bypassing my computer restrictions based on Windows Vista?

My 14 year-old son is using a Ctrl+Alt+Del procedure to get into my computer even though it's password-protected. How can I prevent him accessing my PC? He got that procedure on the web.

Go into the BIOS (usually F2 or Del at boot) and set a boot password. This will be required every time it boots up. Every BIOS is different, so I can't give you step by step instructions, but it shouldn't be too hard to find. This will prevent the computer from booting into any operating system at all, until the password is entered. Keep in mind that you'll still have to put your login password in too, after it boots.

From a non-technical angle, as a 14 year old I would've gone nuts without access to a computer. I don't know what your situation is, and far be it for me to give you parenting advice, but consider giving him access!

Assuming Vista or Windows 7, the alternative would be to give him his own login account, with limited privileges. This prevents him from installing anything, and he can't get at any of your files within your user profile (e.g. My Documents, Pictures, etc). You can do the same on Windows XP, but the limited user design isn't as robust. This would allow him to browse the net and whatever else, without him interfering with any of your documents.


Nginx module security Im considering using this nginx module https://github.com/leev/ngx_http_geoip2_module to get the Information from which Country the IP is.
My question is since im compiling the module by myself, how secure is it if i'm not keeping up with the current version. I'm not a specialist here, so if i'm having an outdated module is it maybe a security risk for the machine or is it not that important since it is an "internal" module which only reads the contents of the maxmind database? The database is on the server itself.

There's nothing bad in that as long as you're subscribed to any security updates list and keep an eye on vulnerabilities.
Also, do subscribe to this module future releases: if you see any mentions of CVEs or fixed bugs, you may want to upgrade.


For encrypted chat app, how can I store sent messages so that they are encrypted but still can be viewed by the sender? Actual implimentaton will be in android but this is more about general security than actual implimentaton details. I'm making an end-to-end encrypted chat app and I know that in order to send encrypted messages you have to encrypt the message with the receiver's public key and they will decrypt it with their private key.

What I'm stuck on is that once I store this encrypted message on the server, the sender will not be able to read their own sent messages because the messages will require the receiver's private key - which they wont have access to. The result is that inside the chat app the sender wont be able to see the actual contents of any of the messages they send, they would only be able to view messages that are sent to them from other users.

Clearly I'd like users to be able to see the entirety of the conversation history, not just recieved messages. I think what I might be getting at is how do I can I store sent messages so that they can be decrypted by both the sender and receiver? Or if I'm thinking about it incorrectly then what is the correct way to solve this problem?

Create a symmetric key, encrypt the symmetric key with receiver's key, encrypt every message with the symmetric key. On the sender side, store the symmetric key together with the message.

Or encrypt the message with the receiver's key, send it. Encrypt same message with sender's key and store it.


Is it possible to find a zip password if it is being generated locally? I have a program that generates a zip file with a password. Is it possible to determine the password if you analyse the program as it is being run? Would calls to function libraries show the password or is there no way to determine the password?

If a password is used, it must exist somewhere readable at some point in time. Whether or not the password is stored in obfuscated or encrypted form will determine what approach is needed in order to recover it. If it is simply stored as a string, hardcoded in the source, static analysis or even running strings on the program may reveal the password. Otherwise, you may need to do dynamic analysis (debugging or hooking functions; dumping memory perhaps) at the point of which the password is used.


Phone got pick pocketed and I got a huge bill I'm really sorry if this is posted in the wrong section. I did spend some time trying to get it right but I am not sure if this is...

I have been exposed to thieves who have stolen my phone and then made over 500 calls an hour where some of the calls cost up to $500. Of course I have blocked my SIM card, but the damage has been done and I am very curious about how the phone companies can let this go through so easily.

I have been in touch with my phone provider (and during the incident I was abroad). My phone provider says they are still negotiating with the abroad phone provider. My phone provider is also a very small company but they said they've been working day and night with this issue.

I will be very straight to the point and ask the questions that I am very curious about:

What device do the thieves use in order to make hundreds of calls per minute?
How can the organizations who make the calls with the stolen phones not get caught? I mean every single transaction is tracked and in order for the thieves to withdraw any money they should have to provide an identity, and bam they should be easy to track down and get charged for the crime?
How can the phone providers (who probably deal with this every day) not be able to block transactions of tens of thousands dollars that are going from one phone to the organizations keeping? It feels like the phone providers are getting paid by the thieves, as long as the phone providers let's those transactions through.

I will answer this based on a vast amount of experience while working at an ITSP

  What device do the thieves use in order to make hundreds of calls per
  minute?

Toll fraudsters can install mobile to voip based apps which connect your mobile device to a Voice Over IP device. The VoIP trunk is then making making calls under your credentials. It works like this:

YourPhone (via mobile to VoIP app) --> make a VoIP call --> rogue VoIP trunk
rogue VoIP trunk --> generate xAmount of calls --> trunk provider

  How can the organizations who make the calls with the stolen phones
  not get caught? I mean every single transaction is tracked and in
  order for the thieves to withdraw any money they should have to
  provide an identity, and bam they should be easy to track down and get
  charged for the crime?

You're dealing with an international issue of which there is no fix. When a call is made it works like this:

Your carrier --> another carrier --> another carrier --> 1..3 --> end destination

Each carrier acted in good faith to place the call for you. There was no way any provider (except the rogue ones) would know a call was fraudulent. Now, in a most cases that I have dealt with, it worked like this:

Victim's Phone (US) --> another US carrier --> carrier in say England --> carrier in Africa

Our laws don't apply in Africa, so it would be more costly for a carrier to go after someone in Africa being they'd have to sue the carrier in England, and the carrier in England would have to sue the carrier in Africa. It is more cost economic for carriers to "re-rate" the calls and bill you for the amount they stand to pay versus the wholesale amount.

  How can the phone providers (who probably deal with this every day)
  not be able to block transactions of tens of thousands dollars that
  are going from one phone to the organizations keeping? It feels like
  the phone providers are getting paid by the thieves, as long as the
  phone providers let's those transactions through.

Regulatory controls (gotta love them). Years ago, Sierra Leone was a known hotspot for fraudulent calls and engineers worked with many vendors to notify them of this however, there was no mechanism to outright block countries known for heavy fraud. There were too many variables (e911, etc). Some carriers outright don't care to stop it, as some profit off of it at the end of the day.


Android soft keyboard architecture I am new to Android. I am trying to figure out how exactly a soft keyboard on an Android device works. What exactly is the 'behind the scenes' process that takes place so that the application is allowed to receive user input and present it to other applications as keyboard input? Can any application do this, or does it involve special privileges?

My actual concern is to find out how exactly key-loggers on Android devices tap keystrokes so that I could figure out how can such an attack be mitigated. Hence I am looking for details in that respect and to that depth.

The keyboard is provided as a service that is registered with the OS.  The OS then displays it when a keyboard is requested and passes the information to the application requesting it.  Most keyloggers are likely registering themselves as the keyboard provider and then displaying the previously selected keyboard and recording the result.  This is why newer versions of Android display a warning when registering a new keyboard provider.


How to brute force only username not password? I want to find the username first, then pass the username and a password list. I could not find flags to ignore password in Ncrack and other related tools. The device I want to find a username is Linux based. Is there a tool to identify the username only?
EDIT: SSH access is needed.

If the system doesn't return a different response when you try to log in using a username, then in that case no, there's no way to see if the username you just tried is valid or not (if it exists, if it's enabled, etc). In that case, if you want to go at it the good old "bruteforce" way, you'll have to use lists of common usernames and passwords, and throw them at the login form.

As stated by @Rasool Ziafaty, doing a bit of recon about the system you're trying to bruteforce your way in can go a long way. Maybe use credentials from data leaks of services that are related to the one you're logged in, or using certain usernames or passwords that are more likely to be used on that specific system (ie: using Anime character names in usernames and passwords if you try to bruteforce a login form for an Anime forum).

This is why the reconnaissance phase in hacking is important and can be the longest one, because before attacking, you need to know what you're going to be dealing with.


To whom do the PCI DSS password requirements apply? The password requirements of PCI DSS, among everything else, state that you must enforce a very specific password policy:

You need to force the users to change their passwords every 90 days, their passwords cannot be shorter than 7 characters, etc.

As far as I know, large companies such as Google, Facebook, PayPal and many more don't enforce that policy.
For example, none of them freeze your account after a period of non-activity as PCI DSS requires and services such as Facebook allows your password to be 6 chars long (which is less than the 7 chars min stated in the PCI DSS requirements).

Those companies are PCI DSS Level 1 Service Providers and are listed in the PCI DSS Service Providers index.

How can those companies be PCI DSS compliant even though they don't enforce the PCI DSS password policy?

On whom does the policy apply? Does it apply on the simple user / customer or is it talking about the staff / moderators?

The password requirements of PCI DSS, among everything else, state
  that you must enforce a very specific password policy:

  You need to force the users to change their passwords every 90 days,
  their passwords cannot be shorter than 7 characters, etc.

  ...

  On who does the policy apply? Does it apply on the simple user /
  customer or is it talking about the staff / moderators?

To quote the DSS 3.2, intro text to Requirement 8 ("Identify and authenticate access to system components"):

Note: These requirements are applicable for all accounts, including
point-of-sale accounts, with administrative capabilities and all
accounts used to view or access cardholder data or to access systems
with cardholder data. This includes accounts used by vendors and
other third parties (for example, for support or maintenance). These
requirements do not apply to accounts used by consumers (e.g., cardholders).

  As far as I know, large companies such as Google, Facebook, PayPal and
  many more don't enforce that policy. For example, none of them freeze
  your account after a period of non-activity as PCI DSS requires and
  services such as Facebook allows your password to be 6 chars long
  (which is less than the 7 chars min stated in the PCI DSS
  requirements).

  Those companies are PCI DSS Level 1 Service Providers and are listed
  in the PCI DSS Service Providers index.

Google and PayPal are; I don't see Facebook on the Visa SP Listing.  But as above, it's not your account - consumer account - that is governed by PCI DSS.  And, especially with a company like Google, it's easy to have an account that never goes near touching a credit card or credit processing function.  So it's not that surprising.


What parameters to check to say that a computer running Windows is slow in responding because of infection? When interaction between the user and the operating system is too slow (Windows become slow in responding to different user's request): what parameters could we check (and that we could use within a program coded in any programming language) in order to say for sure that the computer running this Windows operating system is maybe infected?

I came across this interesting patent titled "Network-based infection detection using host slowdown"

I quote from the abstract of this patent:

  Host malware (or change) may be detected by (1) receiving baseline set of response time information for each of one or more transactions involving (A) the host and (B) at least one peer of the host, (2) determining or receiving a later set of response time information for each of the one or more transactions involving the host and the at least one peer of the host, and (3) determining whether or not host slowdown has occurred using the baseline set of response time information and the later set of response time information. The execution of a host malware (or change) protection policy may be controlled using at least the determination of whether or not host slowdown has occurred.


Can hackers access Firefoxs login storage through the internet? Is it possible for hackers to access my Firefox browsers login storage through the internet? For instance if I visit a malicious website?

The answer, according to me would be yes in cases such as:

Website is able to execute code on your machine and exploit a vulnerability. In general if an attacker can execute code on your machine it doesn't remain your (secure) machine anymore.
You are fooled into entering password on the wrong website using the browser password store.
Finally, vulnerabilities in the browsers password store mechanism itself will lead to access of stored credentials. Refer to:

https://www.bleepingcomputer.com/news/security/firefox-master-password-system-has-been-poorly-secured-for-the-past-9-years/

https://www.threatcare.com/password-manager-vulnerability/

Hope this helps.


Does it make sense to check SPF Record if a majority of customers don't abide their own Records? so I've already disabled error checking for SPF Records after my inital question here: Does error checking for SPF Records make sense?

Unfortunately I still have about 2-10 Companies daily who can't send us emails because their SPF Record has missing IP Adresses, missing includes, etc. etc.

I'm really getting fed up on looking through our logs, searching for all addresses we're receiving Mails from so I can tell those companies how a proper SPF Record would look like for them. I mean they mostly don't even freakin know where their Mails come from...

So all in all, does it even makes sense to check for SPF Records if most of your Customers have SPF Records but they don't abide by them?

So all in all, does it even makes sense to check for SPF Records if most of your Customers have SPF Records but they don't abide by them?

If you work in an environment where most SPF records are broken then it makes of course no sense to care about SPF. This is not specific to SPF: if you know that most of the information you get are wrong you cannot rely on these information in the first place.

But, this kind of broken setup seems to be specific for your environment. At least in the environments I've encountered SPF works mostly fine. It might break though if mails gets redistributed, for example by mailing lists. It might thus be better to not only rely on SPF but additionally on DKIM which is not affected by the redistribution problem (but by others). This is also what DMARC  does, i.e. needs only either SPF or DKIM to succeed.

  ...  who can't send us emails because their SPF Record has missing IP Adresses, missing includes, etc. etc.

SPF is usually not used to deny all mails with SPF Fail. Instead SPF information are commonly used as one of several parts in the spam detection. And, the mail will usually not be rejected but at most marked as potential spam. Explicit rejection is usually only done when there is a DMARC record on the senders domain with an explicit reject policy.


Why should we protect access to password hashes? Why should we protect the access to the password hashes? And under what conditions can this precaution be omitted?

Safe password storage algorithms have two main features: they're one-way, and they're slow.

Being one-way means that given the output, you cannot efficiently compute the input. Efficient means: anything faster than trying all inputs until you get a matching output.
Being slow means that computing an output (the stored value) from the input, takes a while. Because they're one-way, you need to try inputs, and if trying an input takes ten billion calculations on your CPU, then it's going to take a while before you checked all possible passwords.

But what if your password is in the top 10 of worst passwords, like "admin" or "123456"? Then an attacker is going to guess that within a few attempts, no matter how strong your hashing algorithm is.

Therefore, people with weak passwords will always be at risk if their hash is known to an attacker. That's why we keep them secret.

When we log in to a system, we don't want to wait 5 minutes for the server to complete the password algorithm, so those algorithms are still quite fast (something like 0.1 seconds). Because computers get faster over time, we also need to increase the number of computations done, so that it still takes an attacker (with modern hardware) a long time. Or maybe we want to upgrade to a different algorithm that protects against a certain kind of ASIC or GPU cracking program. In those cases, if the old hash is known to an attacker, they can crack the user's password more easily. So additionally, keeping the hashes secret as long as possible, we also have the most up-to-date protection at the moment the hashes get hacked.

Some people include pepper in their password hashes (see this question or Wikipedia), in which case it would be perfectly safe to publish the password hashes so long as the pepper value remains a secret. But then the question is: why would you? There is usually no advantage to publishing the hashes. When the pepper value leaks, attackers can start cracking the oldest hashes you ever published. If you protect the hashes instead of posting them publicly, attackers first have to obtain both the pepper and the user database before they can start cracking anything.

Omitting this precaution (of protecting password hashes) should never be done without the user being warned of the risk. One example of this is a tripcode, where the hash gets published as proof of identity without needing a database. This is the only case that I can think of where publishing hashes of memorized secrets is a good idea. Other hashes, such as signatures of software, are of course a different topic because those do not function as passwords.


Why do rootkits hide in drivers? A lot of rootkits for Windows (maybe even Linux?) do hide in drivers. Why is that?

One reason I can think of is that using a driver they run in kernel mode and have full system access, but aren't there easier ways to accomplish this? Or are there even other reasons?

As you said, most drivers run in kernel mode, so they have access to all the interesting stuff and can easily hide from debuggers.

There are more reasons which makes drivers an interesting place:

There is a huge amount of device drivers, and vendors provide new versions of drivers that differ from the version included in the operating system. So unlike core parts of the operating system, it is not easy to manage a database with hashes of known good files.
There are standard tools and documentation for developing drivers. So this is a lot easier than directly patching kernel memory or replacing the boot loader.
Direct memory access in a device driver is not suspicious.
Some drivers are loaded early during the boot process, so they can apply their magic before a virus scanner is loaded. So the virus scanner only sees, what the rootkit wants it to see.


Security testing on network A group of student have been asked to do a bit of network security testing at college. Basically the college have just invested in some android tablets, more macs and more net books.
The IT admins wants to just double check everything before they put the new equipment out. What would be the main things to check when doing some testing with all these devices?
Such as what are common flaws / settings that people easily overlook.
Obviously there are a few networked drives which students shouldn't have access too but teachers do so this is the main thing to test to see if it can be gotten around. The servers they use are microsoft and Linux servers.
Any tips on things to look out for?
Ps. This is not a question about how to maliciously hack the college network it's genuinely some penetration testing.

Regards

Ross.

If you want a general security test of your servers i recommend using OpenVAS (the new open source Nessus).  This tool will look at version numbers and for some services it can test for misconfiguration.

In terms of the mobile devices them selves,  I don't see how this changes your attack surface.   Just like any end user system, you still have to worry about keeping these devices up to date.  It should be noted that Android introduced ASLR in Ice Creme Sandwich  (A bit late don't you think?),  so update to this version as soon as possible.


HIDS detection system and registry changes I use OSSEC HIDS to monitor XP and Windows 7 Operating Systems.

When OSSEC flags changes in the Windows registry, I have no idea where to go for to look for information and identify if the changes are rather legitimate or if there is an actual intrusion. So, I have two questions:

1) Can someone see anything concerning about the following changes that were flagged in one day's integrity checks?

HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\ialm\Device0
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\lanmanserver\parameters
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\SharedAccess\Epoch
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\WgaLogon\Settings

2) Can someone point me to resources or websites to help me better understand the Windows registry and how to identify intrusions based on its changes?

I'd recommend having a look at the SANS Forensics blog (http://computer-forensics.sans.org), they've a few articles on Windows Registry analysis such as http://computer-forensics.sans.org/blog/2010/10/20/digital-forensics-autorun-registry-keys/.

Here's the link to all their blog posts on Registry Analysis - http://computer-forensics.sans.org/blog/category/registry-analysis.

It might be worth installing the Sysinternals tools for complementary analysis - http://technet.microsoft.com/en-us/sysinternals/default.aspx

Regarding OSSEC, have you changed the configuration or is it the default install? I suspect it could be a false-positive but I'm not an expert on the Windows registry. I think the first three keys are driver-related and the last one has something to do with Windows Genuine Advantage, which I've no idea why that'd be modified.


Minimal HTTPS SSL client in C I want to implement an HTTPS client using pure C. I have implemented an HTTP client, and it works just fine.

My question is: I know the HTTPS protocol does some kind of negotiation to announce what ciphers etc. it supports to the peer. Is it possible to announce that it supports no ciphers, i.e.: like a null HTTPS session?

My biggest obstacle is the implementation of key exchange. The project is for an embedded system and I am not allowed to use third party libraries (OpenSSL etc.).

I have implemented RC4, SHA, ND5 etc., but no public key code. Is there a HTTPS mode that allows secure connections without public keys?

Implementing your own SSL is not a small endeavour. It takes some effort to make it run at all; it takes a lot of effort to do it securely. The cryptography in SSL is subtle, and especially the implementation of the symmetric encryption (with block ciphers) is known to have some vulnerabilities if the decryption and MAC verification are not done with the utmost care (fixed-timing comparison functions and so on).

I have once written an SSL library in pure C, for an embedded system (ARM7TDMI). It supported a few cipher suites (with 3DES and AES encryption). It included a primitive X.509 path validation system (a streamable ASN.1 decoder). Complete code footprint, once compiled, was about 20 kB; the X.509 support accounted for 6 kB, and 5 kB for the AES alone (because of its precomputed internal tables). More importantly, the library performed no dynamic memory allocation by itself; it could run with a single, caller-provided 18 kB buffer.

If you really need to fit in the smallest code size ever, you should implement a single cipher suite using RC4. RC4 has known biases so, cryptographically speaking, it sucks. However, it requires no padding, which avoids a lot of the vulnerabilities implied with the handling of the padding upon decryption, so using RC4 in that case is probably not a bad idea.

You cannot avoid any form of key exchange. Otherwise there would be no point in using SSL. A "null HTTPS session" exists: it is called "plain HTTP" with no SSL at all. RSA-based key exchange is easiest for the client, since it entails only public-key operations, i.e. exponentiation with a very small exponent. You will also need it for validating the server's certificate (RSA signature verification). Some handmade "big integer" code with the few needed operations can be built with few lines of code -- but of course, you have to understand what you are doing.

Read this answer for a description of the SSL/TLS protocol. Also, get the Handbook of Applied Cryptography (free download !), especially chapter 14, that deals with (notably) big-integer arithmetic.

And get your code reviewed. Don't imagine that you can write code with no vulnerability; be ready to do the job again. A software project should be written three times: once to understand the problem, once to understand the solution, and once to do it correctly. Since vulnerabilities don't show up during functional testing, the only way to detect them is to submit your code to several (many) other people and let them look for issues.


Overwrite eip twice for buffer overflow? So I have a binary I've been tasked with exploiting. However, I need to have root privileges to execute
a function in it that (hopefully) gives the password.

There is a function in the program that gives root privileges which I can run with a buffer overflow and pointing assigning the eip to the function's address. The problem is that the moment the program stops root privileges are then lost and the privileges function does not take an input so there's no option of a second overflow.

So I need to overflow the buffer to execute the privilege function which I've done, but I was wondering if there is way to overwrite the eip "twice" so that the second function can be executed after?

Here's essentialy what I need to do in pseudocode form:

./binary $(<padding>*100 + <address of privilege function> + <way to overflow a second time to run next function>

Any tips or help here would be much appreciated.

Keep in mind with an overflow that you are not just "overwriting EIP", you control the stack completely. This then allows you to ensure the next return address on the stack is whatever you want. It only ends up in EIP when it is time to execute it. This is important to understand.

When you redirect control flow to a different function using the overflow, where does that newly called function look for a return address when it's done? Again, the stack!

Using this knowledge plus the proper calling conventions for the program's architecture, we can shape the stack to chain together multiple functions. This is a basic example of ROP (return oriented programming).

For an x86 Linux binary, this is how the stack needs to look regarding calling functions, from lower addresses to higher addresses (in the order you'd overflow):

<function_to_call_addr> <next_return_addr> <arguments_for_function>... <function_to_call_addr> <next_return_addr> <arguments_for_function>... ...

Now, you don't always need to call functions. You can also return to "ROP gadgets"; usually one or more useful instructions followed by a ret. However, if you are not passing any arguments, you shouldn't need to worry about cleaning up the stack or anything. Therefore, your payload should look like:

overflow + privileges + password + AAAA

This calls the privilege function, and tells it that the next return address is the address of password. The next address doesn't matter, since hopefully you've gotten what you've wanted. To be complete, you could change it to resume normal execution of the program.

Let me know if this is wrong. I mostly work with x64 Linux these days so my x86 is a bit rusty.


What algorithm/encryption type does Gmail use for security? In the wake of the recent database hacks, i.e. Sony, Gawker, etc.. where the hackers have access to the hashed usernames and passwords, i've been more keen in paying attention to the sites and services i regularly use, and am paying more attention to how my data is stored. I know that Gawker used DES, i believe, to encrypt their info, which is not as effective as a newer method such as AES.

So do we know what encryption type Google uses or how many rounds of salt they use for their services?

No: Google have not published any details of the internal workings of their sign-on mechanisms.


Should I authenticate user on every request? I'm working on a social network using Vue.js on frontend, and Node/Express on backend. To store user sessions I'm using Redis. I'm wondering if I should hit Redis everytime user requests content, or maybe there is a way to reduce the load?

You should be using session management to handle information transfer between clients and servers.

Session management essentially involves authenticating  a user to initially perform a privileged action, with all subsequent activities being authenticated via 'shared' information eg: cookies.

Asking users to authenticate for each and every action might be considered more secure but will heavily reduce platform usability and overall user satisfaction as a  result.

With regards to database load, without seeing the specific application I can't be 100% however I would advise as long as you are logging the last time the session was used, you don't need to write much other information to the database.


Are virtualized environments vulnerable to the Row Hammer attack? Row Hammer is an exploit which relies on RAM defects to get unrestricted access to the RAM content, allowing to read/write otherwise protected memory and to get higher privileges on the system.

To work, this exploit will access a legitimately accessible memory row in a loop at a very high rate and with no cache, and the frequency of this operation will induce a change in the value of the adjacent, restricted row.

Wikipedia describes the exploit as follow:

  By combining the disturbance errors with memory spraying, this exploit
  is capable of altering page table entries (PTEs) used by the
  virtual memory system for mapping virtual addresses to physical
  addresses, which results in the exploit gaining unrestricted memory
  access.

As per my understanding, while this exploit may be able to provide the attacker a Super User privilege on a guest system (I do not talk about "root" since this attack is not OS dependent), I'm wondering if it can really allow him to escape the virtualized guest and reach either other guests or the host system itself.

While this attack is described as providing "unrestricted access to all physical memory installed in a computer", this memory must still be addressable by the malicious process. As per my understanding a guest virtualized "physical" memory is mapped onto a region of the actual physical memory and several measures exists, both at the hardware (CPU with hardware-assited virutalization instruction sets) and the software (the virtualization software) layers, to ensure it will not be able to address memory outside of this area.
In order to access normally restricted memory areas, the process has to modify the PTEs. Within the guest, only the PTEs of the guest system is accessible, not the PTEs of the host one.
There is a chicken-and-egg problem: in order to circumvent the memory access enforced by the virtualization software, the process must alter its memory. However, since the virtualization software is running on the host system, the malicious process must first be able to address host system memory in order to do this.
Wikipedia's definition mentions modifying the PTEs (Page Table Entries). Modern CPUs provide Second Level Address Tanslation (SLAT, aka nested paging to isolate guest's page tables at the hardware level). Would my assumptions above be bypassable, would this improve the resistance of virtualized systems against Row Hammer?

It depends on your adversary, though I will say no.

At the moment, there are no known vulnerabilities for this attack vector.  Thus, if your adversaries are script kiddies, then you are safe.

It will be a box of chocolates (not knowing what you might get), thus a useless attack:

A vulnerability likely might allow someone to read or modify a different row, but not knowing what information is where makes it nearly useless, thus eliminating most any adversary.
The HV layer can re-map or even swap out memory at any given moment
The HV might have a dozen or a hundred different VMs, there's no way to target one.
The HV might do something like VMotion and move it to a different hardware host
Even doing Row Hammer on the same VM to get elevated privileges is subject to the above, making it unpredictable.

When your threat / adversary has unlimited funding and is targeting you specifically, all bets are off, though likely, they would seek an easier path into the environment, including physical attacks.

Given the number of 0-day vulnerabilities, even those on Hypervisors themselves, Row hammer seems kinda pointless.


Most efficient way to crack a NTLM hash I've been given a non-salted NTLM hash and a week worth of time to find the password it hides. I have also been told the password length is 11 chars, and that it is a Windows 10 user password.

I'm wondering what the most efficient way of trying to recover the password would be? I've tried the sites online that attempt to crack them, and none of them work. However, onlinehashcrack reported they recovered the password (and confirmed the plaintext is 11 chars) but I must pay to unlock it. Either way, this isn't preferable as I will likely need the experience in the future. I've tried both dictionary and brute-force methods in Cain, but it says it will take a very long time on my current setup, and since I only have a week this isn't feasible.

Any help would be greatly appreciated. I haven't really worked with hashes or the like so sorry if this is obvious.

First of all, you can look beyond just dictionary and bruteforce. There are many other approaches possible (dictionary + rules, masks, combinator attacks, hybrid attacks, etc.). The hashcat wiki and/or the John the Ripper (jumbo) MODES doc list a number of the other possible attack types.
You didn't mention what your current capability (hashes per second) is, but I'm assuming that it's either CPU-based, or using a single GPU. If it's CPU, you should try GPU (OpenCL/CUDA), which is dramatically better for some kinds of attacks. If you're already using GPU, then depending on your budget, the most cost-effective method in the time allotted would probably be to rent a GPU compute instance - Amazon, vast.ai, Google Cloud, etc. - using NVIDIA GPUs, and either hashcat or John the Ripper.
You also didn't mention which dictionaries you tried - that matters. The best wordlists are user passwords from other sources, such as the hashes.org founds lists. Using these as wordlists, and then adding rules to "mangle" them in various ways, can be very productive.
In other words, you have many additional options. If you ramp up quickly, you could cover a lot of ground in that week.
Note, however, that while these overall strategies are good at improving your cracking success rates on average ... they're no guarantee that you'll get any specific password. But if you're cracking thousands of passwords, adding these techniques will usually significantly increase your percentage of successful cracks.


Is this vulnerable to an insecure URL redirection attack I have an ASP.NET MVC website that is using Identity for authentication. It runs in IIS 8.5 as HTTP but has SSL terminated at the Load Balancer and is HTTPS for everything between the browser and the Load Balancer.

Here are the certificate details:

My website does an AJAX POST request to a controller action and the controller action returns a JSON response containing a NavigateUrl property. The JavaScript then sets the window.location.href to the value of this property.

Is it possible for this value to be manipulated so that a user of the website can be redirected to a different URL without their knowledge?

There is nothing especially dangerous about the redirect. If someone can modify the URL, they can likely modify any data in the response. That is, your site is totally compromised already.

I would make sure that your web app is generally secure (eg: follows OWASP Top-10). A defense-in-depth security philosophy suggests that you might want to use SSL between the load balancer and app servers.


Sun ILOM / Out of band management security concerns I would like to get some outside opinion on this if possible, although I do not know what to ask.

Sun ILOM is an Out-of-band management system. I understand it is a separate OS on the box that is always on. It is able to access Keyboard Monitor Mouse and other hardware interfaces as well as power on and off the machine.

What is the risk of malicious software on these? (Specifically Sun X4100, but there are others)

I know that it is theoretically possible to install a new OS using the Firmware Upgrade system, and since it has access to all the hardware, it could send information through the network card.

What is the risk of this happening? How can I prevent this type of an attack when installing used equipment?

One assumes that you want to actually use the ILO capability, so "don't plug it into the network" isn't a useful answer.  However, this is one of the few areas where it may make sense to have a separate "management" network.  Put all the ILO interfaces onto a single network and limit that network's access, either via routing, firewall, or ACLs, so that only those trusted administrators machines can access the ILO.  You should rarely need the ILO addresses to be able to go generally outbound, as the whole purpose of an ILO card is just to allow you to get "in front of the machine" without running down to the server room (which can be hours away in many cases).

As far as the firmware goes, it is reasonable for you to update all the firmware yourself.  This not only guarantees an outsider can't slip malicious firmware past you, but it also may ensure that any security updates that apply to that hardware are in place.  As illustration, the following link shows how to update and/or reset various ILO firmware:

http://download.oracle.com/docs/cd/E19569-01/820-1188-12/core_ilom_firmware.html

(Illustration only, I don't doubt that there are 17 proper locations describing how to handle 9 different Sun ILO platforms.  And of course other vendors have their own ILO equivalents which would be handled differently in each case!)

P.S. ILO was originally HP's designation for lights out management, I could have sworn Sun used a different nomenclature, but I can't pull it up at the moment.  However, like many people, I long ago began to use "ILO" to refer to "Whatever the vendor's called their remote access card thingy," so I'll just call it all ILO here.


In regards to GPG4Win, what does "use NAME as default secret key"? 1- what does "use NAME as default secret key" do in Kleopatra tool options?

The reason why I ask this, is I have a looooong password for my certificate. And apparently this becomes a hassle when encrypting several files. So does the option in question replaces my long passphrase with my name? is that what this is?

2- One more thing, I encrypt my files to upload them to dropbox, I don't need to sign them, right? It's just my own files, not sending them to anyone.

3- and lastly, will it make a difference to use long or short passphrase when creating a certificate? Now that I think about it, the file is going to be RSA 4096 encrypted! What difference does the passphrase make?

Thanks.

PS. A recommendation of (current, up to date) 3 Information Security books would be VERY helpful. I don't want to make a separate question just for this :)
1 or 2 Beginner level (introductory)
1 Intermediate
1 Advanced

Double Thanks :)

UPDATES:

So I've read the documentation (that I found by coincidence when looking for something else)

Answers to my own questions (for future users who might have the same question):

1- Still needs an answer!

2- Signing is used to let others know that I truly was the one to send the file. So no, I don't need to sign it when just backing up to dropbox.

3- Passphrase is used as a layer of protection for MY OWN certificate. Say my computer was stolen, or that a hacker got a hold of my certificate file, that passphrase is what will protect my certificate from unauthorized access and thus the hacker won't ever be able to forge sent data and pretend to be from me. The longer that passphrase the harder it is to crack.

QUESTION 1 still needs an answer and books recommendation is even more important now. This is an AMAZING science :D

1- what does "use NAME as default secret key" do in Kleopatra tool options?
  The reason why I ask this, is I have a looooong password for my certificate. And apparently this becomes a hassle when encrypting several files. So does the option in question replaces my long passphrase with my name? is that what this is?

The "default secret key" is the key that Kleopatra will use to sign files with if you don't specify a specific key.

Note that if you're purely encrypting a file, no secret key is involved at all, and thus no passphrase is involved.  It's the decryption (or signing) that requires the secret key.

  3- and lastly, will it make a difference to use long or short passphrase when creating a certificate? Now that I think about it, the file is going to be RSA 4096 encrypted! What difference does the passphrase make?

No, your symmetric key is RSA 4096 bit encrypted.  Your file is encrypted with the public key you're encrypting to's most preferred symmetric cipher that your software supports.  From the command line, use "gpg --edit-key " and the "showpref" to see that public key's preferences, or "setpref" to change them; leftmost is most preferred.  3-key TripleDES and SHA-1 are always, always supported, even if they're not on the list (see RFC4880 for details).  "gpg -v --version" will let you list your version's supported algorithms and the numbers they're assigned.

P.S. Your key's self-signature is probably SHA-1; if you can, generate keys at the command line with "gpg --gen-key --cert-digest-algo SHA256" or "gpg --gen-key --cert-digest-algo SHA512", and then use the edit-key setpref listed above to set your cipher preferences.

P.P.S. an example setpref line (see above) would be "setpref CAMELLIA256 CAMELLIA192 CAMELLIA128 AES256 AES192 AES 3DES SHA512 SHA384 SHA256 SHA1 BZIP2 ZIP ZLIB Uncompressed" - this has a strong preference for Camellia (EU, Japan) over AES (US); please reverse or otherwise change that as you see fit.  It also does NOT list old ciphers like CAST5 or IDEA, nor broken hashes like MD5.  SHA1 is listed only because it's the "must implement" hash.