How do hackers deploy keyloggers? I know the use of keyloggers. What I wish to know is how a hacker can install the keylogger onto the victim's system? If it can be done by XSS then to where this keylogger is actually installed (I mean to the client system or browser or somewhere else)? And also how the response of keyboard press reaches the attacker?

Keyloggers are usually programs which run in background on the users operating system. There are lots of ways to install these on the users machine. Some examples are:

The attacker learns about a vulnerability in the victims web browser which allows to download and install arbitrary programs from the web, and then tricks them into visiting a website they set up to abuse that vulnerability ("drive-by download").
The attacker sends them an executable file which installs the keylogger when executed, and then tricks them into executing it. Common methods do this is through email attachments which masquerade as documents (invoice.pdf.exe) or by masquerading the program as a legitimate installer for another software. It's not difficult to create an installer which pretends to install, say, Mozilla Firefox (and maybe even does this), but also installs other software without the user noticing.
Speaking of vulnerabilities: An attacker could also combine methods 1 and 2 and send them an actual document file which is crafted to exploit a vulnerability in the program they use to view it.
The attacker could put it on an USB device which installs the keylogger when connected to a computer. They then place that device where the victim will find it, hoping that they are curious about the content and connect it to the target machine.
Get physical access to the machine and install it the normal way

About how to get the data from the keylogger back to the attacker: Many keyloggers will use the internet to contact the hacker and send them their logfiles. There are many different protocols and techniques which can be used for this to improve stealth and traceability in this case, and listing them all would go too far.


How to learn penetration testing at home? I am interested in learning ethical hacking or penetration testing to head towards a career in that direction.

I have a strong knowledge of linux and unix, basic computer theory and practice and basic programming knowledge (arrays, methods, loops).

I have looked at gruyere and webgoat, however I find these to be too advanced for me. They ask to solve a problem without sufficiently explaining the problem, why it can be used to attack and giving examples.

Are there any courses or interactive programs, for free, that I can do from home that I can teach myself this information?

A bonus would be giving programming lessons useful in this area, for example teaching JavaScript to demonstrate cookie attacks and manipulations.

Free options are few, but there are tons of videos and tutorials on specific attack vectors or products/tools. They will NOT make you a Penetration Tester, but they are free learning resources.

Some decent options to start you off:

MetaSploit Unleashed: Learn an exploitation framework
SecurityTube: various videos covering a multitude of topics
NMap: The standard network enumeration tool
Web Application Hacker's Handbook: It's not free, but it is the bible on Web App Security

For practice, there are a number of resources:

Metasploitable VM (and other purposely vulnerable VMs)
DVWA
Mutillidae
WebGoat
Vulnhub
hack.me

Do some searching on this site for other people offering opinions on free learning resources. But, the only way to learn is to get your hands dirty.

Keep working at it, and keep asking questions!


Which properties of a X.509 certificate should be critical and which not? RFC5280's section 4.2 states

  Each extension in a
     certificate is designated as either critical or non-critical.  A
     certificate-using system MUST reject the certificate if it encounters
     a critical extension it does not recognize or a critical extension
     that contains information that it cannot process.  A non-critical
     extension MAY be ignored if it is not recognized, but MUST be
     processed if it is recognized.

but I can't find information (preferably a short list) on which extensions should(n't) be designated critical. I encountered the basicConstraints to be critical, both because it's basic and because a certificate marked as CA:FALSE should obviously not be able to sign child-certificates (though I think I read somewhere that pathlen for restricted CAs seems to be ignored occasionally) - but it's also one of the most basic parts of a certificate, which is probably why it's also often not designated critical. keyUsage sound like a good candidate for critical, but what about extendedKeyUsage and subjectAltName?

Is there a short overview stating which extensions should be a) critical b) non-critical c) doesn't matter?

In "pure X.509", it does not really matter if an extension is critical or not, because conforming implementations are supposed to honour the extensions that they recognize, be they marked critical or not. The "critical" flag is for extensions which are not standard: you make such an extension critical if it is important for security (implementations which do not understand the extension should reject the certificate), or non-critical otherwise (implementations which do not understand the extension can then safely ignore it).

There is a slight exception to this rule, with the CRL Distribution Points extension. It has two purposes: to document where CRL can be downloaded from, and to implement scope segmentation. This latter role is active only when the extension is critical. When the extension is critical, then a CRL can be deemed to cover the certificate (i.e. to be able to tell something about its revocation status) only if the CRL contains an Issuing Distribution Point extension, with a "distribution point" which matches one of those specified in the CRL Distribution Point extension in the certificate. When the extension is not critical, the extension serves only in its documentation role.

In practice, you will make extensions critical or not depending on whether they can be ignored without piercing too big a hole in the whole security, and also depending on whether making the extension critical will induce existing implementations to reject the certificate for lack of support. For instance, if you use a critical Name Constraints extension, then you risk unconditional rejection from old versions of OpenSSL (versions prior to 1.0, all of which are EOL, don't support it); but if you make it non-critical, then the same OpenSSL will ignore it. The Name Constraints extension is a typical case of an extension which cannot be ignored safely, and thus should always be marked critical (but interoperability issues make its usage potentially problematic).

RFC 5280 lists, for each certificate extension, whether a conforming CA should make the extension critical or not. These are requirements on the CA and not on validators; a system which validates a certificate must not reject it on the basis that it includes a critical Subject Key Identifier extension, even though RFC 5280 says (section 4.2.1.2):

  Conforming CAs MUST mark this extension as non-critical.

See the RFC for the details on every extension: these are guidelines for how your CA should behave. For instance, Key Usage is a "SHOULD be critical", Basic Constraints is a "MAY be critical", Name Constraints is a "MUST be critical", and so on... If you follow these rules, your security will be fine (but you may have to make some modifications for interoperability).


If C uses shared libraries, is it possible to write a program that will modify the code that opens a file If C uses shared libraries, is it possible to write a program that will modify the fopen function to execute a malicious code? How can the OS protect the user from this?

Yes, that is possible. This technique is called function hooking. In fact, you can completely control an executable by hooking, say, __libc_start_main and redirecting execution to code in the library. There is absolutely no way an OS can protect an executable from a malicious library. The code in the library will run in the same address space as the executable and will have the exact same abilities. The only way to protect an executable from a malicious library is to not link it with malicious libraries.


One Time Password via Text Message: Possible exploits? Is there a credible scenario in which the OTP (One Time Password) for online credit card transactions ( specifically for Verified by Visa) can be bypassed?

Context: A guy I know was cheated via the usual social engineering routes (dumb I know!) into revealing his Credit Card details & a fraudulent transaction was made. The bank says an accurate OTP was entered and hence their liability ends. I tend to agree with them.

The victim OTOH insists that although he did give his Card Number, Expiry date & CVV to the phishers over the phone, he never gave them the OTP received via his cellphone SMS (text message). I find that hard to rationalize.

That's why I'm wondering if there really could be channels of attack that somehow defeat the OTP-SMS protection? The only possibility I could brainstorm is some variant of SIM card cloning.

What do people think? Know any exploit reports like this in the wild? (Normally I'd have not believed the victims insistence that he never revealed the OTP but I'm just playing devils advocate for a bit)

In case it matters, Verified by Visa uses a 4-6 digit OTP sent via text message & it is supposed to expire in  180 secs.

If your friend is telling the truth then there are a few different ways the attackers could have gotten the code:

If the phone is a GSM it's possible they could have cloned his SIM and received his text messages that way
Text messages are processed by systems called SMS-Cs - servers running software that handles text messages which are located in the cell provider's network. If the phishers managed to hack the SMS-C they could have access to every text message in the system
His phone was hacked - phone malware could have given the phishers access to text messages on his phone
An app on the phone leaked the information using permissions. On Android when you install an application it will pop up a message with all the access the app requires. Apps offering the most minor functionality sometimes request to access email, sms, contacts, photos, location, and browsing history - way more than required to do what they say. If you permit an application access to SMS messages it will be able to legitimately forward every SMS you send or receive to a third party. Most of the time this is done to sell to advertisers, however some of these applications are known to have been developed by criminals expressly for the purpose of identity theft and to assist in wider crime.

So it is entirely possible that your friend did not give the criminals the SMS details directly, instead it's quite likely that he gave them indirectly through the apps he installed.


Can you trust the URL shown when 'hovering' on a link? When using a modern web browser, if you hover on a link, the browser will show you the link in a little display on the bottom left corner of the browser screen.

Can I trust this?  Can this display be spoofed?  For instance, can Javascript display something to make it look like the link is to URL A when clicking on the link will actually take me to URL B?

I recently received some advice that, before clicking on a suspicious link, I should hover over the link to see where it will go.  I personally find this extremely dubious and I suspect there are multiple ways that this can be fooled, but I wanted to ask here among folks who may have thought about this more deeply than I.

the onclick javascript action is performed first (did this once to hash a password in browser in a form) and afaik that would enable the site to direct you somewhere else. So no, the destination can be changed between clicking and following the link.


IKEv2 and Dead Peer Detection Some articles and Websites (Wikipedia and Cisco for instance) claim that unlike IKEv1, IKEv2 provides a support for Dead Peer Detection. However, unlike NAT traversal or DoS attacks for example, the official RFC 4306 did not mention how to address this problem. There is actually an official RFC 3706 "A Traffic-Based Method of Detecting Dead Internet Key Exchange (IKE) Peers" whose date (February 2004) preceded IKEv2 official RFC's date (December 2005), however the former was not mentioned in the latter not implicitly nor explicitly. Could anyone please clear this misunderstanding ? Does IKEv2 implement DPD ? If yes are there any official reference(s) ?

RFC 4306 is not the current official reference for IKEv2, RFC 7296 is. Right in the introduction it states:

  Every request requires a
     response.  An INFORMATIONAL request with no payloads (other than the
     empty Encrypted payload required by the syntax) is commonly used as a
     check for liveness.

Then in section 1.4 it defines the following for INFORMATIONAL exchanges:

  The request
     message in an INFORMATIONAL exchange MAY also contain no payloads.
     This is the expected way an endpoint can ask the other endpoint to
     verify that it is alive.

And in section 2.4 it says the following:

  To check whether the other side is alive, IKE
     specifies an empty INFORMATIONAL request that (like all IKE requests)
     requires an acknowledgement (note that within the context of an IKE
     SA, an "empty" message consists of an IKE header followed by an
     Encrypted payload that contains no payloads).

And in the same section a bit later:

  If no
     cryptographically protected messages have been received on an IKE SA
     or any of its Child SAs recently, the system needs to perform a
     liveness check in order to prevent sending messages to a dead peer.
     (This is sometimes called "dead peer detection" or "DPD", although it
     is really detecting live peers, not dead ones.)


How Do antiviruses decide whether a file is to be quarantined or not? Situation: Trying to understand how an antivirus works. So when an antivirus finds a file with a hash value matching their database, it reports it as an infected file and would quarantine it.

Problem: What if the file is a system file? Or if the files are EXE/DLLs required by system to work normally?

Question: How does an antivirus suite decide whether a file is safe to be quarantined?

What if the file is a system file?

Before releasing the signatures to public, the antivirus vendors would test them on different machines with different OS and programs installed. If the signatures contain a hash which detect a system file, and is a false-positive, they'll fix the signatures and re-test them and then release to public.

  Or if the files are EXE/DLLs required by system to work normally?

The reason a detected file is quarantined is that if it is a false-positive, it can be restored to where it was. Almost all the antivirus vendors provide a feature to users to report potential false-positives. If it is found to be a legitimate error, they would fix it in the next update, and that file won't be reported in the next iteration of updates.

  How does an antivirus suite decide whether a file is safe to be quarantined?

If the suite detects it to be malicious by any means(signature hash, heuristic, etc.), it quarantines the file. Now the decision is left to the user if he/she wants to revert it back or not.


Make application use encrypted credentials from a file I am new to cyber security but I am working on a project where I need to use it and I don't know where to start.

The application I am working on connects to Jira to retrieve data and generate reports. For the connection, I want to use a specific username and password. I cannot set them as a string in my code because every user would get my credentials. So, I thought about writing an encrypted file.

The thing is if want to decrypt my file I will need to provide the decryption key in my code. and I think this is not secure at all because anyone that had access to the key could easily decrypt the file and therefore get my credentials.

I found a method that encrypts a file and makes it so that the only person that would decrypt is the user who encrypted it. The problem is that the admin is the only one who has the right to encrypt the files and this will only mean that he would be the only one for whom the connection to Jira would work as he is the only one able to decrypt the credentials.

I am also worried that if I read and decrypt the credentials then anyone could use a console.writeline and get the credentials.

I am using c# for my application.

Are there any ways I can secure my credentials?

To connect and retrieve data from JIRA I need the username and password because I add them to my request header to connect and retrieve data.

There is a bit of a Chicken and Egg Problem.

The only thing that can be used is User Permission on the Device.
That means that there is a File that only the User from the Application can Read (OS-Permissions) or a Services where only the Logged In User has access to (example: Windows Credential Management API).

Any other option is just more Obfuscation than "Encryption". How will you encrypt something, where you get a secret, without enter the another secret but other users should not get your secret. All options just go to a deeper Obfuscation (first Hardcoded, secound a scrambeld String, then a scrambeld String with another Random String linked,...)


Security of next generation firewall In recent years there's been a number of IndieGoGo or KickStarter projects for smart device protection, or next-generation firewalls. Some examples are: Anonabox, Cujo, Dojo, Firewalla, Keezel, RATtrap, Vektor

Now the established network/router manufacturers are getting in on it with their own new products: Avira Safe Things, Cisco Meraki, Eero, Fortinet FortiWiFi, F-Secure Sense, Google WiFi, Linksys Velop, Luma Surround WiFi, Ubiquiti Unifi Security Router, Securify Almond3...

While I can find 'reviews' on many of these, they all have one thing in common, the reviewers are repeating the features the original marketers listed. There is a lot of hype and marketing, but I've been unable to find substantial articles of proven performance.

Has anyone found/done any real-world testing? Do the one wire products reliably filter all packets to/from all devices, or do they miss large chunks of traffic? Do these things really protect any better than conventional routers? Are they more frequently patched for vulnerabilities?

Has anyone found/done any real-world testing?

For example NSS labs does various tests. But since it is their business to help others decide what to buy the detailed test results are only available for money. Some vendors though provide the details on their own website - but of course only if these are good results.

  Do the one wire products reliably filter all packets to/from all devices, or do they miss large chunks of traffic?

There is always a balance between speed, price and depth and quality of inspection. This means these firewalls can be bypassed and often in trivial ways (disclaimer: this is my own research) as NSSLabs shows too (which used my evasion tool). And while many of these reported problems have been fixed there are several unreported which still work.

But in general you can say that you get what you pay for. The cheaper a device for a specific throughput is the less analysis it does, which means it also protects you less. But none of the devices offers full protection.  And no matter what some claim, I don't believe that any of the vendors has the secret "patent-pending" "military-grade" sauce which makes it possible to provide the same level of security and performance for a significantly lower price than all the others.

  Do these things really protect any better than conventional routers?

Definitely. A router does not offer much protection in the first place. These NGFW analyze at the application level, check the reputation of sites you visit, analyze mail ... - nothing of this is done by a router.

  Are they more frequently patched for vulnerabilities?

Some vendors have obviously more problems writing secure code while others have less problems. Just look at the reported vulnerabilities before you buy something.

But all of this does not mean that you need to buy the most expensive device to protect your network. What you actually need depends on your specific risk, which depends on what you protect but also how you protect it already. If all your sensitive data are offline than you don't need an NGFW but likely a better lock or a safe or a surveillance system since the main thing you have to worry about are physical attacks.

And even if the data are on networked systems it might be better to have separated networks depending on the sensitivity of the assets, use microsegmentation inside the network or your zero-trust concepts like BeyondCorp to protect your data. Depending on your specific use case and risk they might protect you better for the same costs than some next generation perimeter firewall.

In contrast to what especially the cheaper vendors tell you: security is not as simple as putting some fancy device on the network and be fully secure.


Is captcha on nth login attempt is really stops bots? I have a requirement to show google reCaptcha on 2nd attempt on login screen.

But frankly speaking I consider it not the way to stop bots.

Because on server side I cannot tell whether  this is the first or second login attempt unless the user chooses to send some kind of cookie along with the request so I can identify which number of login attempts he is trying  - hence HTTP protocol is stateless in nature.

And I believe bots are not stupid to send some cookie that make the server figure out any information about them.

I heard about some sophisticated solutions like a js script to run on the login page load to generate some id and then to send this id to the server and make the server to check this id, but still an intelligent-enough bot can simulate all this actions. but this is not what I am asking about.

Any advice?

Storing the number of failed logins in the session or in the cookie does not work. As you pointed out, the attacker can simply delete the cookie. A better way is to keep the number of failed login attempts on the server, corresponding to the user name or the IP address used. If someone enters the wrong credentials, you increment the counter for that IP address or for that username on the server. This way the client can not alter it.


Am I being attacked? I saw this in the error log in the cPanel and I think someone is accessing my files.

[Sat Oct 01 07:05:38.875312 2016] [:error] [pid 430322] [client 52.10.104.14:36382] File does not exist: /home/mysitename/public_html/wp-login.php

I am newbie, please help me.

You're probably fine, this was likely an automated scan searching for WordPress installations across the Internet. If that's the only log entry, I'd ignore it.


How secure is an Apple-encrypted image? I wonder how secure the encryption on Mac is when creating an encrypted disk image. Is there any information about the "security level" when creating such an image? I'm curious because if I create an image, it is so fast.

If I create an encrypted image with VeraCrypt, for example, it takes much more time than creating one with Apple. Why is that?

According the documentation it states that

  After you click the ‘Format’ button in the Volume Creation Wizard window (the last step), there will be a short delay while your system is being polled for additional random data.

So that might take some time. Also it depends on what options you use when creating the VeraCrypt volume especially if you don't use Quick format which is unchecked by default which will fill the volume with random data. I don't think Mac does this or may do it in the background.

As long as "security level" of what Apple provides, this is not really known since their code is not open source and there is little technical documentation around their encrypted volume so there is no way to know if they are following security best practices.

Here is an article with some technical details on encrypted dmg format and how it can be cracked.

According to linked article "

  AES256-encrypted DMG uses 250,000 rounds of PBKDF2-HMAC-SHA-1 to generate the encryption key

So the "security level" is pretty good when it comes to the encryption algorithm (AES) but the key derivation (PBKDF2-HMAC-SHA-1) is known to have weaknesses. According to Wikipedia

  One weakness of PBKDF2 is that while its number of iterations can be adjusted to make it take an arbitrarily large amount of computing time, it can be implemented with a small circuit and very little RAM, which makes brute-force attacks using application-specific integrated circuits or graphics processing units relatively cheap.The bcrypt key derivation function requires a larger amount of RAM (but still not tunable separately, i. e. fixed for a given amount of CPU time) and is slightly stronger against such attacks,while the more modern scrypt key derivation function can use arbitrarily large amounts of memory and is therefore more resistant to ASIC and GPU attacks.


`pass` not asking for password anymore - gnome-keyring or gpg-agent related? How can I force password asking? I cross-posted this on the manjaro forums and on server fault. So far no answer, so trying here.

I have gnome-keyring running for sure, not sure it's gnome-keyring or gpg-agent or ssh-agent related...

I use pass as command line password manager for many things. Usually, when querying pass, a dialog would appear asking me to enter a password first. I assume it was gnome-keyring asking me for my password. It may well be gpg-agent or ssh-agent - I don't know.

However, since some time ago, it does not ask my password anymore - thus, anyone with access to my shell can use pass to see my passwords, as they are printed on STDOUT. I must have clicked on the option to somehow save my password I guess.

I want to enable pass to ask me for my password again. How do I do that?

You should check if either or both the gpg-agent or gnome-keyring daemons are running. Some display managers will automatically start gnome-keyring. I've never used it. gpg-agent is a separate daemon and can sometimes cause conflict.
In ~/.gnupg/gpg-agent.conf, you can declare to cache your gpg key password for a period of time. My config reads:
pinentry-program /usr/bin/pinentry
default-cache-ttl 60480000
max-cache-ttl 60480000

Which will cache the password for the maximum amount of time. I use the /usr/bin/pinentry GUI application to pop-up and ask for the password the first time something like pass asks for it. This would not work on a headless system; I think by default it just asks on the command-line.


Chat to original IP via VPN encrypted? Background

I wrote a small server and client for a unencrypted chat in java.
I now wanted to make the communication between the server application and the client application encrypted.

So i thought the following might work but i'm not sure about it:

If I do the following steps, will the traffic between the server and the client be encrypted?

Activate a VPN on the computer where i also start the server application
Start the Client Application on another computer
connect the Client to the Server by connecting to the "real" IP adress and
a port of the Computer where the server is running, but not the IP it has   cause of the VPN

The VPN blocks all traffic outside of this connection. So the client has to connect via the VPN connection was what i thought.

If your computer is a VPN client and another computer tries to connect to it without going through the VPN, it will not be encrypted unless your application does its own encryption.


Is storing an encrypted zip file to an insecure cloud service an admissible way of securing privacy? Consider the following scenario:

I use a cloud service that is not considered secure (meaning no encryption whatsoever) i.e. Dropbox, OneDrive, Google Drive etc. In my account I have a .zip or .7z file that is encrypted using a very strong password. For the sake of argument, let's say that I used PeaZip to create this file.

My question is: How safe should I feel? In the case where my account is breached, should I feel safe that this particular file will not be breached (baring in mind that the password is indeed unique and very very strong). Is this kind of measure acceptable if one cares about his/her privacy?

Privacy and confidentiality are different things...

A Zip file, even encrypted, is still there, and onlookers may observe not only the archive presence, name and size, but also the individual names and sizes of files within the archive, because these are not encrypted.

Traditional Zip encryption is weak and can be broken within a few minutes, regardless of how strong the password is — a good example of why homemade ciphers are an abomination. Some Zip-aware software can do better (e.g. with AES), but this may limit interoperability. For instance, Windows's explorer cannot open Zip archives encrypted with something else than the weak traditional stream cipher.

The normal, pervasive defence system of most people is to be utterly boring, thus making it unlikely that any potential attacker would bother trying to unlock their secrets. Yet, if you believe that an hostile adversary may actually try to learn your data and has access to your files stored in your cloud service, then you might consider making an unencrypted Zip archive, then encrypting that archive as a whole with GnuPG. GnuPG, among its many options, can do password-based symmetric encryption (with the -c command-line option) and does it reasonably well. The presence and size of the archive will still be known to eavesdroppers, as well as the archive file name, but archive contents, including individual file names and sizes, will be protected.


Minimal working configuration for reasonable security in openssh on Linux I want to connect from my laptop to home server (both run some Linux; notice I explicitly want my user to be able to become root, in order e.g. to install new software): the server has the following sshd_config:

AllowUsers <zzz-my-user>
PermitRootLogin no
HostKey /etc/ssh/ssh_host_rsa_key
ChallengeResponseAuthentication no
PasswordAuthentication no
# PubkeyAcceptedKeyTypes ssh-rsa*
LoginGraceTime 8
X11Forwarding no
PrintMotd no
MaxStartups 2:30:10
AcceptEnv LANG LC_*
Subsystem sftp /usr/lib/openssh/sftp-server

on the client I acted with

mkdir ~/.ssh
chmod 700 ~/.ssh
ssh-keygen -o -t rsa -b 4096

and then added the public key in the server at .ssh/authorized_keys, where I also acted with

sudo ssh-keygen -o -N '' -b 4096 -t rsa -f /etc/ssh/ssh_host_rsa_key

Do you think this minimal procedure and configuration might guarantee a reasonable security level? Would you suggest any improvements?

If you are running fairly recent version of openssh, I would recommend rather

PermitRootLogin without-password

It should not matter if you do not allow password authentication (but for further when you will decide to allow it for some reason).
Not sure what you mean by "to be able to root", but if you want to allow root login, you also need to list that user in AllowUsers option, if <zzz-my-user> is not root.
UsePrivilegeSeparation sandbox is current default. It works fine and adds another layer of security.

Further options depends on your use cases that you need to use and what you want to protect against. But generally forbidding Tunnel, Port forwarding or X11 forwarding might be way if you don't want to use it.


Methods to have multiple Anti Virus installed on one machine I am running Windows 8.1 Pro, Ideally I would like to have the top 5 Anti Virus installed but I am aware it is not advised as they can clash with each other.

I was wondering if there is a favoured way to do go about this, the first thing that comes to mind is have only 1 of the 5 anti virus running at any time to avoid the realtime conflicts between them.

My goal would be to have these Anti Virus scan my PC at different intervals each day.
Something like when its 11am Begin scan with Avast & disable other the other 4 Anti Virus, when its 1pm begin scan with Norton and disable the other 4 Anti Virus, etc...

Some Anti Virus pick up infections which others do not...

If this is a bad idea, please offer some suggestions.

If you really want to do this, the method with the least stability impact is to disable on-access protection, URL protection, email scanning, and everything else that scans at the time of potential infection.

Note that this is "method with least stability impact", not "best method".  By configuring your system this way, you ensure that you will be infected by any virus that enters your system.  You're counting on the antivirus software being able to remove the virus after it's been installed -- not a good idea, since viruses can and do disable antivirus software, and sometimes the only reliable way to remove an infection is a format-and-reinstall.


Writing files in a sub folder of the web folder (apache security) I need to save session data for a dynamic web page script by writing to file. I have two questions:

Are there any security preferences as to whether to save the data UNDER the web folder, or OUTSIDE the web folder?
I attempted to write to the folder an (unsuprisingly), I had a 'file permission refused' type error. Should I set the folder ownership to the apache user (600, 640 or 644?)

[[Edit]]

core     <- 'OUTSIDE' web folder (php script live here)
data     <- 'OUTSIDE' web folder (session data and other misc data resides here)
web      <-  web root folder
   js    <-  any folder below is 'INSIDE' the web folder
   css
   html

For example, in a php script (i.e. a dynamic PHP page), I can attempt to write to a file using something like fput('../data',data) yet (as I understand it) ../data should not be accessible - for security reasons.

Could someone please provide a simple example that shows how to provide access to ../data/ in the example given above?.

What are the actual SPECIFIC steps required?

BTW, I am running on a LAMP stack.

There absolutely is a security preference to save sensitive data outside of your web root. If you don't want random users being able to access the data, then don't put it under web root.

Sure, you can set the file permissions to be non-readable or configure Apache to deny access to the file or use mod_rewrite to block attempts to access the file, but these security mechanisms are much more error prone and more inconvenient than simply putting sensitive data outside of the web root. And session data definitely qualifies as sensitive data.

And what to set the folder permissions to depends on your server setup. On a standard LAMP setup, PHP will execute as the same user as Apache (often nobody). However, under shared hosting the PHP script is often run under the domain's own SFTP/shell user. But either way, you shouldn't be giving other users read access to your session data.


How does non-ephemeral Diffie-Hellman key exchange become compromised in SSL when the RSA private key is leaked? From my understanding, one of the major reasons we recommend Diffie-Hellman Ephemeral (e.g. DHE or ECDHE) over non-ephemeral DH, for SSL / TLS, is that compromise of the RSA private key (i.e. private certificate) would allow an attacker to decrypt previously captured conversations. In contrast, ephemeral should prevent decryption unless the attacker is in posession of the key at the time of the conversation.

How does this decryption of non-ephemeral Diffie-Hellman key exchange work in this context? Is it simply a case of observing the unencrypted primitives that are exchanged over the wire? If so, what is the point of using DH, if it provides no additional security over encrypting the key with RSA, and RSA already provides authentication of the server?

First let's be sure that we talk about the same thing. In SSL, there are "ephemeral DH cipher suites" (DHE) and "non-ephemeral DH cipher suites" (DH).

With DHE, the server private key (the permanent one, the one which is stored in a file, and whose public key is in the server certificate) is of type RSA (DHE_RSA cipher suites) or DSS (DHE_DSS cipher suites), and is used only for signatures. The server generates a new random DH key pair (the private key will not be stored, which is how perfect forward secrecy is achieved: a private key cannot be stolen afterwards if it has never been stored), and sends the public key to the client, in a message which the server signs with its RSA or DSS private key.

With DH cipher suites, the permanent server private key is a DH private key. The server certificate contains the DH public key. The server cannot see its RSA key be stolen because the server does not have a RSA key. The server only has a DH key. When a cipher suites is called "DH_RSA", it means "the server key is a DH key, and the server certificate was issued (i.e. signed) by a Certification Authority who uses a RSA key".

Stealing the DH private key of one party involved in a DH key exchange allows ulterior reconstruction of the shared secret, just like RSA. In "ephemeral DH", the PFS is obtained through "ephemeral", not through "DH". Technically, it would be possible to have "ephemeral RSA" but it is not done in practice(*) because generating a new RSA key pair is kinda expensive, whereas producing a new DH key pair is cheap.

(*) Ephemeral RSA keys were possible with old versions of SSL as part of the "export" cipher suites, meant to comply with the pre-2000 US export regulations: the server could have a 1024-bit signature RSA key, and generate an ephemeral 512-bit RSA key pair for key exchange, used in encryption mode. I don't recall having ever seen that in the wild, though, and it is a moot point since US export regulations on key sizes were lifted.

Non-ephemeral DH cipher suites exist in order to allow servers with DH certificates to operate. DH keys in certificate exist because in older times, RSA was patented but DH was not, so standardization bodies, in particular NIST, were pushing DH as the must-implement standard.

Reality caught up with that, though. I have never seen a SSL server using a DH certificate. Everybody uses RSA. The RSA patent expired a decade ago anyway.


SSL Newbie : Does HTTPS client also need a certificate? I am calling an HTTPS URL through a Java program. Does my Java client need to provide a certificate to the server to establish this connection? In other words, do I need my own certificate or is the server's certificate (which contains its public key) enough?

Depends what you are doing, and what you want to verify. If you are accessing data, and want to be sure that the server which knows the corresponding private key is the one sending you data (e.g. you're accessing a web page), you don't need your own certificate.

If the server wants to be able to verify that the client is a pre-defined one, which knows a private key corresponding to a public key recognised as a valid source, your client will need a certificate. This tends to be used when a pair of servers are communicating - they each sign the data with their own private key, and can verify that the data is coming from a known source by checking against public keys. It can also be used with some APIs, where only specific clients are intended to access.

At a guess, therefore, you don't need your own certificate for your client - it's generally fairly well documented by the server if you do.


Is there a secure way to run a bat file from a Java program without command injection vulnerability? Since using Runtime.exec() and ProcessBuilder trigger command injection vulnerability in static analyzing tools, is there any other recommended secure way to execute a bat file from a Java program?

Java code:

Runtime.getRuntime().exec("C:\\batFile.bat")

FindBugs analysis:

I'm not really familiar with Java but I've seen the same problem with other languages. The issue is that when exec is called with a string the OS shell need to be involved it needs to parse the command string into the command and arguments. Although this is not done by letting the OS shell do the splitting as in many other languages like Perl (thanks for dave_thompson_085 correcting me) it nevertheless can have unintended results since the splitting is done simply by white-space and does not care about quoting or escaping. For example if the intended argument in constructing the command is a user defined filename, the user might provide a filename containing spaces which will be split into multiple arguments then although it was intended as a single one. Depending on what is actually executed this might also lead to unintended command injection. This is similar to SQL injections which can happen when constructing SQL statements from user input or with XSS and other kind of code injections.

The solution is thus the same as with parameter binding to defend against SQL injection: make sure that no parsing need to be done by the shell to extract the arguments by providing the relevant parts already parsed. With exec this means to not give a command string but instead a command array, i.e. something like this (nur sure if the explicit cmd.exe and /c are actually needed):

String[] cmdArray = new String[3];
cmdArray[0] = "cmd.exe";
cmdArray[1] = "/c";
cmdArray[2] = "C:\\batFile.bat";
Runtime.getRuntime().exec(cmdArray);

See also Stackoverflow: How do I run a batch file from my Java Application?.


Origin of side-channel attacks What is the origin of side-channel attacks? Is it related to the algorithm or to the implementation? In other words, is the software responsible for the attack or the hardware?

Is there a cryptographic algorithm that is resistant to side-channel attacks on system A, but is not on System B?

Can we call algorithms side-channel resistant?

Side Channel attacks leverage information gained from observing or interacting with a system in a way other than anticipated by its creators. Often this is done to infer information about encryption keys or other secret information.

Some of the most common side channel attack vectors are:

Timing
Power monitoring
Error handling analysis

Examples for the mentioned include:

AES cache timing attack to determine encryption keys (very good paper by DJ Bernstein)
Differential power analysis against DES to determine encryption keys (famous paper by P Kocher)
RFID passports' error handling is exploited to infer nationality -> privacy breach (link)

While Wikipedia states that:

  ... a side-channel attack is any attack based on information gained from the physical implementation of a cryptosystem ...

I would argue (along with Bernstein and others) that side channel weaknesses may also emerge from design. In the AES example this is due to the fact that it is pretty much infeasible to write constant-time performing code for general computing while maintaining efficiency.

So to come back to your question; while you exploit a side channel attack in an implemented system, the root cause for its existence cannot generally be attributed to implementation only. You will have to look at a specific system and its implementations, and you may find that the answer to the question depends largely on where you place the boundary between design and implementation.

(If the design of AES had guaranteed static computing times, the timing attack would not have been feasible on any correct implementation as an example...)

You may, however, have differing implementations of AES which are or are not vulnerable to a timing attack, to answer your question about systems A & B (System A may enforce static computing times while B does not).

With a well-defined attacker model I would say that you could define a side channel resistant algorithm. Please clarify that question tough - not sure I understood you fully..

Edit: Some more fun and interesting reading in this brief and easily readable article. :)


Best practices for vulnerability patching periods? I was wondering if there are any general recommendations on maximum resolution times for vulnerabilities.

Consider a vulnerability/patch management process where a ticket is opened when a vulnerability is reported/detected. The ticket system sets a maximum resolution time based on details of the vulnerability, such as:

Criticality of the vulnerability—critical vulnerability result in a higher risk, thus organizations cannot afford to remain vulnerable for long,
Availability of a solution—vendor-reported vulnerabilities typically come with a solution in the form of a patch, while other cases may require a thorough (and potentially time-consuming) analysis.

If it is anticipated that a solution will not be available within the resolution time, mitigating measures need to be discussed. If the resolution time is exceeded, the ticket is escalated (resulting in an extension of the solution time and/or additional mitigating measures).

Are there any general recommendations on what the resolution times should be, or how to quantify them?

Quantifying the time to remediate is a function of the assessed risk. Risk is a function of impact and likelihood of the impact occurring. That's the general recommendation, and the organisation needs to work that out for itself.

A corporate policy helps define the default time for remedies to be applied based on the organisation's risk tolerance and the benefits of consistent operation. Each organisation has a different level of risk tolerance along with processes and procedures that need to be accounted for in the decision.

A few 3rd party standards organsiations issue guidance for what they think the current best practice is. They are not risk-informed, but rather an industry-expert opinion. Cyber Essentials from the UK's NCSC, for example, sets the timeframe for critical patches at between 14-30 days.

But once you decide that remedies need to be applied as soon as they are available, then the entire conversation shifts to what barriers and reasons for delays are acceptable to the organisation. That is a completely different conversation and is no longer a function of the vulnerability/patch/outside risk, but rather the operational realities and operational risks that the organisation wants to take on. And frankly, this becomes a much more useful and fruitful discussion.

If a remedy is available now, and it could be applied, why wait 14 days? There are tons of valid reasons to delay for 14 days, or even 40 days or longer. The real question is what types of delays are acceptable to the organisation? What needs to be accounted for in the remediation process? Are those delays actually valid or are they excuses and convenience?

So, I would flip your question around to assuming that remedies need to be applied as soon as the vulnerability is identified, with acceptable delays that account for unchangeable operational realities and operational risks that might outweigh the risks inherent in the vulnerability.

Or, if you just want a static number from experts, Cyber Essentials says 14 days for criticals and highs.


FireFox Download Source While downloading the latest version of Firefox for Mac, i took a peek at the source.  The names don't look legit but i am not that familiar with how CDNs work.

I hit download multiple times and found these sources, which i got from the "from" portion:

http://mozilla.mirros.aarnet.edu.au

http://mirror.metrocast.net

Is this legit?

When I tried downloading from https://www.mozilla.org/en-US/firefox/fx/ I was pointed to http://mirrors.coreix.net once, then http://mozilla.mirror.nexicom.net/, then http://mozilla.c3sl.ufpr.br.  Whether this is the way Firefox's download page is supposed to work or not, I do not know myself.

A more appropriate way to resolve this though, would be to ask:  "Where can I find official hashes of the Firefox installation files?".  This has been asked and answered on Mozilla's support forums.

Start here, and pick the version of Firefox you want.  Then, look for and open a file called MD5SUMS or SHA1SUMS (depending on your preference) in that version's sub-directory.  Within that file are hashes for all OS- and language-specific versions of the installer for that edition of Firefox.  Find the name of your installer, and compare the hash to one that you run yourself (using your tool of choice) on the file that you've downloaded.

Even better, from that starting point, you can just navigate to the folder that contains the installer you need and download it straight from Mozilla instead of a mirror.  You should still verify the file hash as described above.

Still, if you're really paranoid about downloading a virus, you may want to consider this:

Does hashing a file from an unsigned website give a false sense of security?


Affordable web application attack tools I've been using Burp Intruder (part of Burp suite), but in the free edition of Burp Suite the Intruder functionality is Time-throttled. As a student pen tester however, I can't justify the cost of $300 a year for the Burp Suite Professional Edition.

I know there are other great intercepting proxies out there (OWASP ZAP), but I'm after something specifically that simulates the burp intruder core functionality, mainly the login validation checks via either 'pitchfork' methods.

It doesn't need to be integrated as part of a intercepting proxy suite, a standalone tool is fine also. It must be free or very low cost.

Any suggestions?

There are a lot of free tools out there. You may not find a free tool with the exact same functionality as Burp, but you could use several tools to compensate for the limitations of Burp's free version.

use Owasp ZAP or Webscarab for their proxy functionality.
use Nikto and W3AF to scan web applications.
use SQLMap to exploit SQL injections vulnerabilities.
use XSSer to detect and exploit XSS vulnerabilities.
use Powefuzzer to fuzz parameters
use online encoder/decoders
use DirBuster to find hidden resources

All the tools mentioned above and several others are by default installed in recent Backtrack releases.

If you are looking for a tool that is closest in functionality with the Intruder, then I think that Wfuz with it's WebSlayer GUI is the one to try.


Where am I most vulnerable when running Mac OS 10.6.8 Snow Leopard? I have a challenge at work, one of our computers is running Mac OS 10.6.8 Snow Leopard. We have legacy software that's required to run the business, and so we have to have it online and on our network. This is a huge pain because I can't install most pieces of current software that would benefit from a new OS.

Because the OS is so old, what are the attack vectors that make it vulnerable (browsers perhaps?), and how can I harden the security as much as possible without actually taking it off the internet?

Mac OS 10.6.8 has LOT of known CVEs, to be not exhaustive, and to go beyond browsers vulnerabilities, you OS is for example vulnerable to:

Directory Service which allows remote attackers to execute arbitrary code or cause a denial of service (daemon crash) via a crafted message (CVE-2013-0984),

Its also vulnerable to multiple stack-based buffer overflows in the phar_set_inode function in phar_internal.h in PHP before 5.4.40, 5.5.x before 5.5.24, and 5.6.x before 5.6.8 allow remote attackers to execute arbitrary code via a crafted length value in a (1) tar, (2) phar, or (3) ZIP archive (CVE-2015-3329)

As well as being vulnerable to Integer overflow in the Security Framework that allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via crafted input.

You can see a list of known vulnerabilities here


OpenPGP key transition: strong RSA subkey under a weak DSA masterkey? I have a DSA/ElGamal 1024/2048 OpenPGP key and want to migrate to a stronger set. I see two options but I'm unsure which is smarter.

keep DSA 1024 masterkey, generate 4096 RSA subkey
ditch the whole thing and generate a brand new pair

The payoff is definitely trust (keeping the old signatures) versus security (strong master key). I can't say which outweighs.

When keeping the old DSA masterkey, is it possible to generate an additional new key for signatures?

The payoff is definitely trust (keeping the old signatures) versus security (strong master key). I can't say which outweighs.

If you continue using the old DSA primary key, all messages encrypted for the new RSA subkey will not be in danger when your DSA key is compromiseds, nor are signatures issued by a new signing subkey. Given usable subkeys are available, they will be used for "day to day" work. The primary key is only used for certification and key management tasks in this case.

This means that an attacker could create new subkeys (which might be automatically picked up for encryption and issue valid signatures, of course!) and revoke the old ones, he could issue certifications, but he cannot read messages encrypted to the RSA subkeys you generated.

I'd go for the second scenario, create a new key pair and issue a certification from your old to your new key. After a time and getting some new certifications on your new key, ditch the old one by revoking it. Consider sending a key transition statement.

  When keeping the old DSA masterkey, is it possible to generate an additional new key for signatures?

You can of course add a new signing subkey, but not a subkey for issuing certifications (signatures on keys).


Does ATA security support or allow for 2FA? I understand TCG OPAL is the spiritual successor of ATA Security for hard drive encryption with SEDs. They claim there is support for biometrics etc, but how is it for the predecessor, ATA Security?

Is it just a 32 bytes ASCII password, or do some motherboards offer 2FA, e.g. in the form of a USB stick or OTP?

The ATA Security feature set is very limited. It has only a few different capabilities:

Erasing - Wipes the drive with manufacturer-specific data.
Locking - Blocks access until a 32 byte ASCII password is provided.
Freezing - Prevents modifying security settings until the next restart.

This is all it can do. Locking ATA drives can be done using either the master password, which is a manufacturer-defined skeleton key, or the user password, which is set by the user (or NULL by default). When the drive is set to high security, the master password can be used in lieu of the user password. When the drive is set to maximum security, the master password can only be used to erase the drive. Setting a security password involves sending a SECURITY_SET_PASS command along with the password type and the password itself, in the form of 32 ASCII bytes padded with NULLs if shorter or truncated if longer. Unlocking the drive is similar, except it uses the SECURITY_UNLOCK command.

A drive can be in one of several security states, from SEC0 to SEC6. From the ATA 8 standard:

A state transition table is available at figure 12 in section 4.20.11 of the same document. A nice and less technical overview of the ATA security feature set can additionally be found here.

So no, 2FA is not supported, only locking and unlocking with a 32 byte ASCII key is.


What is a salami attack? Can someone give a clear definition of a Salami Attack? In the book Security in Computing (4th Edition) by Charles P. Pfleeger.

It is stated as a attack to data integrity and I quote the passage:

Data Integrity

  Stealing, buying, finding, or hearing data requires no computer sophistication, whereas modifying or
  fabricating new data requires some understanding of the technology by which the data are
  transmitted or stored, as well as the format in which the data are maintained. Thus, a higher level

  The most common sources of this kind of problem are malicious programs, errant file system
  utilities, and flawed communication facilities.Data are especially vulnerable to modification. Small and skillfully done modifications may not be
  detected in ordinary ways. For instance, we saw in our truncated interest example that a criminal
  can perform what is known as a salami attack: The crook shaves a little from many accounts and
  puts these shavings together to form a valuable result, like the meat scraps joined in a salami.

Can someone give me a better definition of What is a Salami Attack? And what are the Methods to prevent it?

Nope, I don't think @munkeyoto has got the right idea.

The following passage is from Bruce Schneier's Secret And Lies.

  There’s the so-called salami attack of stealing the fractions of
  pennies, one slice at a time, from everyone’s interest-bearing
  accounts; this is a beautiful example of something that just would not
  have been possible without computers.

A salami attack is a small attack that can be repeated many times very efficiently. Thus the combined output of the attack is great. In the example above, it refers to stealing the round-off from interest in bank accounts. Even though it is less than 1 cent per account, when multiplied by millions of accounts over many months, the adversary can retrieve quite a large amount. It is also less likely to be noticable since your average customer would assume that the amount was rounded down to the nearest cent.

The chained exploits that munkeyoto is referring to is a series of different exploits each having a small impact but when combined, has a large impact.


Does OpenID Connect provide CSRF and XSS protection? I've been reading several articles recently about how storing JWTs in local or session storage is inherently insecure. The mitigation is apparently to implement a "session ID pattern", i.e. create a session ID, which is stored in a signed HttpOnly cookie and is also included in the JWT, in which case both can be compared server-side to make sure the token corresponds to the right session.
From my limited understanding of the OpenID Connect spec, it seems like that session pattern is part of the specification (as state parameter), so I'm assuming that using a compliant implementation should be enough to protect against CSRF/XSS in this particular context.
Is this a correct assumption? Does OpenID Connect spec include CSRF and XSS protection for JWTs?

Binding a JWT token to a session does not protect from CSRF and XSS attacks. The OpenID Connect specification does not include CSRF and XSS specifications, and it conceptually just cannot include it.
CSRF
An attacker tricks a user to click on a button, image or link, that triggers some malicious action like transfer $1000 to some account., where as user is not aware of this action. From the server point of view the request will be absolutely correct. In particular, the session ID from httpOnly cookie will be present and valid, also the JWT token will be present, valid and will refer the valid session ID. Thus the server will execute the request.
To protect from CSRF a request should contain something that only server knows, what attacker doesn't know. There are different techniques (synchronizer token, cookie-to-header token, etc.) In all cases this part of the content is provided by the server itself, not by the 3rd party service that issued JWT token.
XSS
XSS leads to generation of DOM and/or Script that causes undesired behaviour. Again, from the server point of view any such request will contain valid session ID and valid JWT token.
The protection from XSS includes filtering of input and, on client side, escaping of response elements that are not expected to be DOM elements. JWT does not help to protect from XSS.


Protecting against GCHQ port scans: How does TCP stealth work? Today I read the first time about a draft of TCP Stealth which should serve as a protection against GCHQ and NSA vulnerability scanning(Source: https://en.wikipedia.org/wiki/TCP_Stealth):

The proposal modifies the TCP three-way handshake by only accepting connections from clients that transmit a proof of knowledge of a shared secret. If the connection attempt does not use TCP Stealth, or if authentication fails, the server acts as if no service was listening on the port number. (Source: https://en.wikipedia.org/wiki/TCP_Stealth)

* What are the differences between TCP Stealth and Single Packet Authorization?

* What are the advantages of TCP Stealth compared to Single Packet Authorization?

The difference is that SPA has a separate authentication step taking place over a UDP port before the SSH port is opened. In TCP Stealth, authentication is performed inside the SYN packet that initiates a connection with the protected service.

An advantage of TCP Stealth is that it does not need to keep track of which ports are "opened". It only needs to keep track of state like a normal TCP stack does.
Another advantage is that no application need to be installed on client systems when this goes widespread. It will simply be built-in to all computers. So upon connecting to a resource, you could tell your operating system to embed a password in the SYN packet.
A third advantage, since an out-of-band authentication step is not performed, a NAT router could easily add authentication data to specific SYN packets to perform network-to-network authentication (like it was a VPN tunnel between the routers but without the encryption).  This would provide access to a specific service to all computers behind a specific NAT router. The same thing with SPA would either require 2 connection attempts or a long waiting period to connect.


Does NAT break source port randomization? The standard defense against the Kaminsky attack is to use source port randomization for all DNS requests.

Does NAT break the security benefits of source port randomization?

In more detail, consider a client that sits behind a NAT.  Suppose the client uses source port randomization for all DNS requests, and issues a request.  When the request traverses the NAT, the NAT may translate the source port number to a new source port from within the NAT's pool of local port numbers.

I worry that, if the NAT uses a predictable port assignment strategy, this may derandomize the source port on the packet -- leaving the client open to a Kaminsky attack.  Does this happen in practice?  Do NATs translate the source port on DNS requests?  Do they use predictable source ports?  If this is a problem for some NATs, does anyone know how prevalent the problem is?  Do NATs these days take any measures to avoid screwing up source port randomization?  Is there anything one should do, when configuring a NAT, to ensure the NAT doesn't make you more vulnerable to Kaminsky attacks?

Obviously the implications are going to be implementation-dependent. The NAT device is free to choose any source port desired, and some implementations may have historically used sequential port numbering. But with newer hardware this is becomming increasingly unlikely.

Specifically, newer routers prefer to use the client computer's original source port (particularly for UDP) specifically to allow NAT traversal using a technique now called UDP hole punching.

At one point this was considered a sought-after feature for gaming, Skype, etc., but now it's pretty much expected.

Also, bear in mind the in most instances, the router sets itself up as the preferred DNS server for its network, then runs a forwarding resolver locally on the device. This would mean that port randomization on the client computer would be irrelevent; instead the randomization would need to be a feature of the router's DNS resolver.


How are PCRs Checked and are external TPMs vulnerable to hardware attack Are boot measurements checked against PCRs by the TPM, or is the PCR is reported and the measuring software does the check?

Since the PCR validation enables the release of some secrets in the TPM, I guess it must be done by the TPM.  So what is to stop me from spying on the reported measurements written to the TPM on the LPC bus, then spoofing that communication later?

Is this a realistic attack vector?

Measurements are taken by software, then extended into the PCRs held by the TPM. The TPM can enforce restrictions on who and when can extend and reset which PCRs (though this is pretty much set in advance, per the table section 3.1 in TPM 1.2 spec part 1). Those PCRs can be read by pretty much any user on the platform, and seen on the LPC bus.

The TPM doesn't perform any validation on PCRs--the measurements extended into PCRs and the order in which they are extended is up to the software performing the measurements.

The TPM uses the PCRs for a variety of lockdown functions (e.g. securing data through a seal or bind operation). When the PCRs are used in this way, the TPM uses its own PCR storage, as opposed to receiving the values over the LPC bus. When PCRs are provided for remote attestation, the PCRs are accompanied by a TPM quote, which is a signature of the PCRs made with a key that only the TPM can use for signing. If PCR values are manipulated in any way, this manipulation can be easily discovered. There are really no opportunities to use spoofed data to gain access to secured data.

If an attacker has access to the LPC bus, a denial of service might be possible by spoofing a locality to extend data into a PCR used to secure data. In most cases, only the expected PCR values can be used to retrieve PCR-secured data. By extending a PCR used for this function, the value would change from the expected value.


How can GNSS spoofing be so easy? Don't the satellites sign their messages? BBC News reports that a new study accuses Russia of massive GPS spoofing (see also this linked blog article).  I am surprised that this is so easy¹, in particular since GPS originates as a military system.  Couldn't such spoofing be quite simply prevented by signing each message with a private key?  Has this been done and have those keys been stolen?  Or is there some (fundamental?) reason why such a protection is not feasible for GNSS?

I would expect that if this were simple, it would be done.  Why isn't it?

¹Russia is also able to pull off feats that are not easy, but I've been told that this particular one happens to be quite easy.

Ultimately, the answer is that there is no way of preventing jamming and fine spoofing in GPS or a GPS-like system due to the inherent principles of which it operates.

RF systems are always subject to jamming. You can make it more difficult, as modernized GPS does with error correction, higher powers, and multiple frequencies. But you can always overwhelm a receiver with a huge signal.

Encryption in the military code does prevent gross spoofing, where contents of the message are modified. However, it is fundamentally impossible to prevent all spoofing in a 1-way broadcast system.

GPS operates by measuring the relative delay between the signals transmitted by multiple satellites. There is no way to guarantee whether a delay was real, caused by the travel of the signal in space, or if the signal was artificially delayed, say by recording the signals and playing it back slightly later.

Environmental effects, namely the ionosphere and reflections between buildings, naturally do this for us and are major sources of GPS error.

To summarize, there is no way of authenticating a variable time delay by cryptographic means in a 1-way system.


Metasploit reverse_http(s) PAYLOAD for linux target During exploitation via metasploit's browzer_autopwn, I need to set a payload using http or https channel on a linux target. But there is no reverse_http(s) available in linux payload category.

What can I use as payload for reverse http / https channel on Linux target ?
How can I explicitly set the output proxy http of the target network to the payload (no such configuration in payload options) ?

If reverse_http(s) is not in your payload binaries then you can manually add it. You can download and add the payload from the link below. At the bottom of page there is a download link

https://funoverip.net/2012/10/metasploit-stager-reverse_https-basic-authentication-against-proxy/


Wireless - why can't i view ARP broadcasts in monitor mode on encrypted networks? I'm running a packet capture on my test client (running in managed mode) and also on my attacking machine (running in monitor mode).

It is my understanding that 802.11 networks using WEP encryption do not encrypt ARP packets. This would make sense, as I need to capture an ARP packet in order to perform aircrack-ng's ARP request replay attack.

This changes when I switch my AP to WEP-Open. When I perform the replay attack, I see the ARP packets on the test client as expected. But when I generate ARP requests on the client (i.e. pinging a nonexistent IP address), the corresponding 802.11 data frames that my attacking machine picks up appear to be encrypted. The hex data of each data frame is different for each data frame.

Why can't I see the unencrypted frames?

Because they're encrypted

It is my understanding that 802.11 networks using WEP encryption do not encrypt ARP packets.

Nope. Instead the attack relies on the very fact that they ARE encrypted.
From the aircrack-ng docs:

The classic ARP request replay attack is the most effective way to generate new initialization vectors (IVs), and works very reliably.
The program listens for an ARP packet then retransmits it back to the access point. This, in turn, causes the access point to repeat the ARP packet with a new IV. The program retransmits the same ARP packet over and over. However, each ARP packet repeated by the access point has a new IVs. It is all these new IVs which allow you to determine the WEP key.


alias in certificate Why when I create a certificate in XCA software and import this to token and list certificate token in opensc, I don't see alias? But when I generate a certificate with openssl I have alias.

Due to sourceforges step-by-step guide you can set an alias for the canonical host name in the Subject tab during the creation of a CA-signed host certificate. The guide says:

  [...] For host certificates, the common name must be the FQDN to which
  you wish users to connect. This need not be the canonical name of the
  host, but can also be an alias. For example, if pluto.example.com is
  your web server and it has a DNS CNAME entry of www.example.com, then
  you probably want the Common Name value in the certificate to be
  www.example.com. [...]

I this what you intend to do? If not, provide more information (if possible).


What is the impact of removing TLS_RSA_WITH_RC4_128_SHA from my server's cipher suite? I run a website that supports many clients via webservices.  I'm setting up some new certificates and load balancers and when doing ssllabs's server test, it's flagging all my ciphers as OK except TLS_RSA_WITH_RC4_128_SHA.  What would be the impact of removing this cipher?  In other words, what clients might have issues connecting without it?  I still have clients running some older stacks like WebSphere and Java 1.6.

The overall cipher suite determines compatibility, not the presence or absence of one cipher.  You'll need to test different configurations to find out.

If you're already doing SSL Lab's server test, then that's your best resource for determining the impact of the change.  When you say you're

  setting up some new certificates and load balancers

that suggests that you can experiment with changes to these systems because they aren't in production use yet.  So remove TLS_RSA_WITH_RC4_128_SHA and re-run the SSL Server Test and pay attention to the Handshake Simulation section of the results.  That will tell you which clients will have problems, like the following config where IE 6 on XP is unable to work with my cipher suite:

Now, that server has RC4 completely disabled, and the only two clients that are incompatible are IE 6 on XP and Java 6u45 - but Java failed because "Client does not support DH parameters > 1024 bits", not "Protocol or cipher suite mismatch" which is what I'd expect to see if the lack of RC4 was the problem.

SSL Labs is an awesome tool because it allows you to play with different configurations to get the balance of security and compatibility you need.  Based on my results, I suspect you can get by without RC4 (my server's increased DH requirements are relatively new to Apache, for example).  But this is really a case of YMMV.  You might want to use cipherli.st to guide you in trying out new configs.


Use Public/Private key pair for password authentication Is it safe to generate a public/private key pair from a users password using PBKDF2, and send the public key to the server to store as the user's key? Then when the user logs in, it would again generate the private key from the password, and use that to communicate with the server.

The salt would be generated by the server and sent to the client as part of the signup form; however, this salt would be completely unique to each request, and the chosen salt would be sent back to the server with the public key.

My thought is that this would solve the problem of tying up server resources if many users wanted to sign up. I am also wondering if it would be any more secure than simply salt and hash a million times.

Obviously, this is vulnerable to a MitM attack during sign up, but what isn't? It should be immune to an eavesdropper, correct? Except for password strength.

The main problem with your plan is that PBKDF2 is used for generating symmetric keys only. To generate a public/private key pair, you could potentially use the output of PDKDF2 to seed a random number generator and then use that RNG when coming up with the public and private keys. However, Javascript lacks the ability to seed the random number generator. So you'd have to roll your own, use a library, or generate the keys on the server.

I am struggling to see the point of all this, though. It seems like you are interested in using this mechanism to encrypt data in flight, but that is already taken care of by SSL/TLS. If you just want to encrypt data at rest in a manner where the server (and its administrators) are unable to access it, you could just use a symmetric key.


Does transmitting first 6 and last 4 digits of the card number and expire date require PCI DSS compliance? If we transmit 16 digit card number from a service provider to my application then PCI DSS is applicable.

But if we use (transmit/store) only the first 6 and last 4 digits of the card number and expiration date, then are we required to comply with PCI DSS?

From a PCI DSS standpoint it is not considered "Cardholder Data" unless it includes the full Primary Account Number (the 16 digit card number) so if that never touches your systems then they are indeed out of scope.

If you are looking at it beyond purely PCI then I would look at whether you actually need that much - transmitting/storing the first six and last four leaves only 10,000 possible combinations to get the "full" PAN, there is still some work to go from there to get sufficient details to "steal" the card but unless you have a specific reason for needing that much of the PAN why do it?


Ads appearing in our application when they should not be I received a strange issue reported by one of my web application users. Apparently they are getting "ads" within the browser window when using my application.

I didn't add advertisements at all. It's a straightforward ASP.NET web application.

What I believe is happening is that the end user's PC is infected with malware that "hops" onto their browser session to display the ads. This could happen with any website, I guess. I recommended they scan their PC with Malwarebytes.

Is this something that can only be controlled by the end-user, or are there steps that web application developers can take to prevent this from happening? In addition, some hints regarding the mechanism employed by this type of malware would be nice.

While I also believe the most likely explanation is definitely that the users system is infected with adware, I would like to present some alternative explanations.

There is still a small possibility that your website is indeed serving advertisement. It isn't unheard of that criminals hack into insecure web applications and modify them to deliver ads or malware. When they do, they might take precautions to conceal this from the administrator, like serving unmodified output to certain IP ranges. When you receive similar reports from many other users, you might want to check if any source files on the server got modified somehow.

Your server could also serve advertisement because of an unlicensed 3rd party library you are using. There are, for example, DotNetNuke modules which inject advertisement into the website when they aren't properly licensed (thanks to Jasmine for the comment).

Another possible explanation could be that the advertisement isn't injected by you or by adware on the users machine but by a man-in-the-middle. The user might use an anonymous proxy server to improve their privacy. Some of these proxy servers generate revenue by injecting their own advertisement into the websites they relay.


Calling someone with a broken SIM card? My friend broke her (Australian Telstra pre-payed) SIM card in half just so she couldn't be contacted anymore.
Now every time I call her it's saying
"The number you have called is not connected. Please check the number and try again!"

I find that quite odd.

Is that the correct Telstra message that I should be getting?
or, surely it is meant to go through to MessageBank!
It seems more likely that message means that she has deactivated her number and got a new number.

Because I can't imagine a just a broken SIM card would terminate the phone number completely.

I can only imagine a broken SIM would behave more like a SIM that's only been removed from the hone and would go straight to Message Bank. Am I right or wrong?

You're right.

From view point of the provider, a broken SIM is as good as a good SIM in a turned-off phone, in a phone without battery, or outside of the phone. The phone won't "log in" to the network anymore with the data from the SIM, and that is all the provider can know.

Unless, of course, your friend got in contact with them and told them that it is broken. And then of course, if a replacement with the same number isn't wanted (or possible), the number will get deactivated.


who signs the certificate (Root CA or an intermediate authority? Are certificates issued by a Trusted Root CA signed by the private key from the Root CA or rather by an intermediate certificate ?

thx

If the certificates are directly issued by the Root CA (which is usually only Intermediate CA certs) then they are signed using the Root CA private key.  The certificates typically issued to servers or users are signed with an Intermediate CA private key one or two levels down from the root.


Is it safe to run a flask server in a development environment? I have a project that I have to present on a Zoom call for my AP Computer Science class. I have a flask site that I am running off of my laptop onto a port forward. When I run the server it says:

WARNING: This is a development server. Do not use it in a production deployment.
Use a production WSGI server instead.
* Debug mode: off

I only plan to run this for a couple of hours, and it doesn't need to be particularly efficient, but I don't want to open my computer up to attack. (I know it's very dangerous to run it in debug mode like this). The web app doesn't have any sensitive data to be stolen, but I wanted to make sure I wasn't opening my machine to remote code execution, or anything like that.

My understanding is Flask is not recommended for production because of stability rather than security. With WSGI or Gunicorn, you can utilize multi-thread/multi-proc more effectively, and serve multiple requests simultaneously.

If you're a beginner it can be daunting to go from Flask to WSGI (Gunicorn is slightly easier, but still has a learning curve). If this is just for a few hours to demo something to your class -- I'd say just go for exposing Flask, with the following caveats.

Ensure the port you're exposing to the internet is sufficiently
random (don't use 80 or 8080), try something like 48982, or 13892,
etc -- this reduces your attack probability immensely :)
Don't run flask as a root user, preferably create a scoped down user, that only has access to the files you wish to expose

Hope that helps.


How can a novice find proof of a system compromise? I am almost certain a colleague has installed a keylogger on my system. I am totally new to IT security, but have substantial linux / windows / programming experience.

The system I believe is compromised is running windows 7 with Eset smart security. Any compromise would be from custom-written scripts (likely python.)

Can someone point me in the direction of resources I would need in order to find the compromise? It would also be helpful if I could then find the origin of any infiltration.

I'm looking to spend 10-30 hours on this, and more if it yields solid results. I'd obviously like to implement measures to counteract future attacks - so long as I'm not dedicating more than 5 hours per week on it. Is this possible?

Are there IRC channels or forums I could check out for more in-depth security / forensics information?

Thank you!

There are many ways to go about finding key loggers.  Some are more time consuming than others and may also provide false-negative.

Purchase a well known anti key logger software.  Or take your chances with a free distribution.

This is your first defense and the easiest thing you can do.  A scanner may find suspicious files or process and flag them.  At this point, you do research on these processes and find whether they are legitimate or not.

The software may not always work because a good key logger may hide itself very well.

Scan your computers ports and log all traffic.

Research if your computer should be transmitting particular traffic or not.  This can be very time consuming depending on how many programs/services are installed.

If you find anything out of the ordinary here, you can research and find out what the traffic is for.  A typical question you should ask is, should I have port 80 open on my computer?

This method may provide a false negative because the key logger may not be running or sending information at that time.

Compare files to known good files

This may be very time consuming depending on how many files you have.  To do this, you can take an md5 hash of your file and compare it to a md5 hash of a good file that is on a default install with the appropriate updates and software, or a known good back up.  If the files are different, the md5 will be different.  You should probably should mount the hard drive so you know the current operating system isn't running.

Ask yourself whether or not the files will be different.  Log files will be different, the page file will be different, etc.  You might be looking for system are that are different.

Have any files been added?

Find out whether files have been added compare to a default install or a known good back up.

Research whether or not files are legitimately installed on your computer.  For instance, it may look like Skype is a legitimate program, but you never installed it.  A key logger could be disguised as something like that.

What else can I do?

Check if your boot loader is infected.

Use a rootkit scanner.

Check your firmware.


What is required to ensure users' information being sent over my website is secure with the use of account log ins I have inherited the responsibility of managing my company's website.  There are some customers who are required to submit highly confidential information via the website using online forms.  I have been asked to develop user accounts so that we can add "another" level of security.  Basically what I'm looking for is:

Users should be able to log into a secure account on the website (similar to those used in online banking)
Users' confidential information must be secure while being sent over the website.

I need clarity on what exactly is required to achieve these mentioned above - any help will be appreciated.

Only provide the pages over HTTPS (most servers have a requires HTTPS option).  HTTPS will make an SSL connection that will protect the information in transit.  On the server side, what you need to do to store the information depends greatly on the type and sensitivity of the information, as well as how it will need to be used.

For example, is it information that the client will need to be able to later retrieve, is it financial information or PCI (payment card information)?  Do employees of your organization need to be able to access it?  Does the information need to be able to be shared with other (select) clients?


Downloading software from websites that lacks a padlock Some websites don't have a padlock symbol to the left of the URL in Firefox.
The only symbol is the letter "i" in the center of a circle - colored in gray.

How do I know whether it's safe to download software from them?

(BTW, even security.stackexchange.com doesn't have a padlock.)

The padlock is just a visual cue used by the browser to show you that your traffic is being encrypted when sent and received from the server. It represents an SSL Certificate but for this answer we can just use the term padlock.

The padlock does not make any claims of trustworthiness, it merely shows whether the traffic between your computer and the server is encrypted, that is it cannot be seen (in clear text) by other people sniffing traffic between the two endpoints).

In fact, many times attackers will purchase SSL certificates (the padlock) to encrypt traffic to evade Intrusion Detection Systems (IDS) and Intrusion Prevention Systems (IPS), so seeing the padlock should not automatically equal safe content.

Recommendation

Instead or relying on the padlock, use reputation based content filtering and pay attention to the domain used in the URI to avoid social engineering / phishing scams directing you to unscrupulous content.

Examples:

paypal.com != paypa1.com
google.com != g00gle.com

UPDATE

As noted in the comments below, there are Man in the Middle (MitM) attacks that can fool a victim into thinking they are connecting to a legitimate source (DNS cache poisoning), as well as subtleties in language character sets (IDN homograph attacks) that can look like the English (Latin) Character set.
Credit: @iismathwizard


When does a company need to hire a dedicated security specialist? Currently, we don't have a specific dedicated penetration or security tester/specialist in the team.

We've been scanned and audited by different companies specialized in internet security and we've been addressing the discovered issues using the forces of the backend development, frontend development and DevOps teams. Sometimes though, we did realize that we could've found some of the issues earlier, before the audit, if paid more attention to security testing.

At what point and what would be the signs of a time when a company would need to hire a dedicated security specialist and what would be the advantages/disadvantages of that action?

I'd like to keep the question generic, but will provide any details if needed.

Now.

The fact that you are realizing that issues are being found so late in the SDLC is a sign you need to hire security people. But here's the difficult part. There are many different disciplines in Information Security, and you may need to hire more than one person to cover the different disciplines. For example, the following are each different skillsets. There may be some overlap, but you'll be hard-pressed to find someone who is skilled at everything that has the depth necessary to get the job done correctly.

Software Architecture
Network Architecture
Code Review
Penetration testing
Vulnerability assessments
Risk management
Developer education

There also should be questions about where you want a security program to mature to. If you hire penetration testers that just find vulnerability after vulnerability, you'll end up with developers who keep writing bad code, because their mistakes aren't caught during the development process. Or during the design process. It's really hard for me to tell someone "yeah, I found this serious design flaw. You'll need to rip out a bunch of code to fix it." That's financially expensive. Human-time expensive. And developers don't really get education out of it.

It should be noted that even within each of these disciplines, there's different skills. For example, software architecture can be someone who is embedded in a team, but from the security team, helping design software. Or it can be someone who takes documentation near the end of the design process, reviews it, helps the team understand design flaws. Both approaches have their pros and cons. Or you may find people who are good at risk management when it comes to physical security, but not information security. Or people who are good at vulnerability assessments, but not good at penetration testing.

Take stock of what the company needs now, and start developing a security program around that.


Is it unsafe to allow apps other than Outlook to send email via the Exchange server? My application is a .NET Windows Forms client, one of whose functions is to allow the user to send personalised mailshot emails to opted-in recipients stored in the database.

The emails are sent using the .NET System.Net.Mail classes, from the client computer on which the application is installed, directly to an SMTP server within the client's firewall.

The customer secures this relay by:

specifying the computers that are permitted to send the emails

and optionally by:

specifying that the client application provides user/password credentials.

Of about 30 customers, one is unhappy with this arrangement on the grounds that:

if the client machine became infected with suitable malware, it would be possible for the permitted computers to act as spam relays.

Now, I realise that in theory, malware that contained a password grinder could eventually break the user/password credentials.  However, Outlook is already permitted on the client computers, so I don't understand why (given the existence of libraries such as Outlook Redemption), if allowing Outlook to send mail is safe, allowing my company's application to send mail is any less safe.

Would appreciate any pointers.

Edit:

Thanks for the replies so far... if I could add a supplementary:

I notice a couple have pointed out that Outlook doesn't use SMTP.  However, neither does Outlook Redemption, a perfectly legitimate COM class library that allows, AIUI, authenticated MAPI communication to Exchange servers.

So if malware that had taken over the client machine could eventually grind out a password, and bypass (as does Outlook Redemption) the Outlook object model, and hence Outlook's security against programmatic access, could it not wreak plenty of havoc?

My question is really not so much about absolute safety - clearly that's never achievable - it's whether if there's a concern about getting malware at all, why would my authenticated application be any less safe than Outlook.

Your customer is not wrong - or rather, might not be.

If there is no password requirement, any user or app on that computer can send emails - whatever they want, as much as they want, to whomsoever they want.
But even more than that - they can send the emails from whoever they want. E.g. from the CEO, or VP HR, or...

So authentication should always be a requirement.
Moreover, though this may be out of your scope - their Exchange server should be hardened, to never allow unauthenticated connections.

Now, is a password enough?
It depends...  can malware misuse your application to spoof and/or spam via their Exchange? (The answer is most probably yes - either via object models, DDE, .NET reflection, or even just stealing your app's password from storage).

Regarding Outlook, to the best of my knowledge, the object model requires user approval before sending mails from external apps.

Bottom line, you can make it more difficult, but not impossible - but then, you don't need to, since spam is already pretty cheap to generate even without you - you just have to make it hard enough.


Domain redirecting to my site without permission I noticed that a domain that I don't own or know has been redirected to my site without my permission and has been affecting my SEO. I was able to block some of it by adding the following to the .htaccess file:

RewriteEngine on
# Options +FollowSymlinks
RewriteCond %{HTTP_REFERER} badsite\.com [NC]
RewriteRule .* - [F]

However, the homepage still shows up. Is there another way I can completely block it?

Contact the registrar that the domain is registered with.

You can use any WHOIS search engine to gain the abuse contact details for the registrar, as well as (providing that they haven't made the WHOIS data private) the owner's contact details. I often use the who.is search for WHOIS information (I find that there are a few 'WHOIS search' providers out there who are actually registrars).

The section you'll be interested in is this:

Domain Name: EXAMPLE.COM
Registry Domain ID: 000000_DOMAIN_COM-VRSN
Registrar WHOIS Server: whois.register.it
Registrar URL: http://we.register.it
Updated Date: 2015-08-20T00:00:00Z
Creation Date: 2015-05-20T00:00:00Z
Registrar Registration Expiration Date: 2016-05-20T00:00:00Z
Registrar: REGISTER.IT S.P.A.
Registrar IANA ID: 168
Registrar Abuse Contact Email: abuse[at]register.it
Registrar Abuse Contact Phone: +39.0353230310

Obviously the registrar's information will vary from domain to domain, but you'll still be wanting to know this info:

Registrar Registration Expiration Date - If the domain is expiring inside a month, I personally wouldn't bother reporting it unless you feel it is doing you serious harm or that the domain's expiration date is extended (the owner will probably get notifications that it's expiring a couple of weeks prior)
Registrar Abuse Contact Email/Phone- Here's where to contact to have the domain investigated for abuse (this includes purporting to be another website, which is the case here). If successful, the domain will be suspended.

You will also be interested in the Registry Tech ID: section of the WHOIS record, which lists additional details for the registrar. Depending on whether the registrar is a reseller, this information could be different to the information mentioned above.

If you still can't get hold of the registrar, contact ICANN directly (if it's a domain regulated by them), or the appropriate regulator for the TLD or SLD of the offending website. If the registrar won't do anything about it/can't contact they the regulator will.


How can I securely recieve an Orgs secret key? They could just send it to me over the internet? More or less just clarification requested?

If I'm a "NEW" client for VPN the only way I can access the Server's VPN that I'm trying to join says I have to know a secret shared key...(This is their standard)....

How can they securely send this shared key to this new client?

One way I have developed is I created an app that will take any phrase, encrypt it and provide that key to the user...

This will ensure that they have the same key...

But if someone developed an app using the same encryption method and had the "phrase" they could potentially have the same key?

Any thoughts?

The client connects to the VPN server using HTTPS, presents himself there in a way they deem acceptable (usually by filling a sign up form, perhaps also performing a payment). The VPN server provides him the data he needs for the connection (that included the preshared key).

Your approach of "created an app that will take any phrase, encrypt it and provide that key to the user" does not work, because you are simply changing the problem of providing the shared key to the user to providing the phrase used to derive the shared key (note: I would consider what you describe a case for hashing, not for encryption).


Is it good to not have keyboard-based sequences in our password generator? If we have to write a password generator, is it a good idea to contain a "keyboard-based sequence" checker? So if the generated password is:

asdf4%'Q!76342

Then this password will be rejected by the generator, and it generates another, because of the "asdf".

Question: Is it a good idea to remove the passwords that has "keyboard-based sequences" in them? Or it will just produce passwords that can be statistically broken, since we know that the passwords will not have "asdf" in them? Which solution is better?

I would say yes. @Philipp does make some good points, but how many passwords would actually fall out if you remove keyword based sequences? Probably not enough to make any real difference (depending on how you actually filter, of course).

The probability that such a password is generated is (probably) incredibly low (so another question is if it's actually worth the work to implement such a filter), but if it actually does happen, it would be quite bad, because then that generated password is easy to guess, which is exactly what you want to avoid with generated passwords.

When you do filter, the length of the keyboard based sequence that you filter should be in some reasonable proportion to the password length. So if you generate passwords of lenght 15, filtering out asd is probably not a good idea (because asd in a long password doesn't lead to easily guessable passwords, but you would actually exclude a rather wide range of passwords). I would probably exclude the password if it contains a sequence of length of about  password.length - 4 (4 additional characters to a sequence seem enough to avoid simple bruteforce).

If you do filter the generated passwords, I would also filter against a list of common passwords (you really don't want your password generator to generate 123456 or password1).