Security, Penetration Testing

• A

  Door locks & deadbolt appropriate for exterior office door with decorative glass next to it
  physic languageal doors • • amarantha  

  3
  0
  Votes
  3
  Posts
  4
  Views

  D

  Contact a local locksmith that deals with sliding glass door locks, they probably have a solution to this problem.
• C

  How to generate a unique and uncopyable VPN certificate/key for a specific client hardware device?
  authentication certificate vpn hardware openvpn • • courtlanda  

  3
  0
  Votes
  3
  Posts
  10
  Views

  

  I just add a little bit about hex format and its usage. Hex codes helps simplify binary codes in many areas of computing. Hexadecimal is not used by computers - it is used by humans to simplify binary to make it easier to understand. Any information written in hex format doesn't understand by computers. That's why computers can translate hexadecimal into binary form. Manualy converting information written in hex format is quite tedious and consume a lot of time. However, an online hex to text conversion utility will be benificial to do the task in a few instances.
• 

  Preventing users from tampering with input
  javascript api trust single page app input validation • • Mystic  

  2
  0
  Votes
  2
  Posts
  2
  Views

  A

  TL,DR: It's impossible to do so client side. Client side validation is just a client convenience, not useful to really validate anything. You don't want the client to mistype his email, putting an invalid char somewhere, and have to wait the form being submitted, the server parsing it, and sending back an error 5 seconds later, you want the error to show instantly. You validate on the client, but you ignore the client validation entirely and validate again on the server. If the validation is made client-side, the client may submit the request by hand, bypassing all validation. Even if you use hashing, signing, obfuscating or anything else, the result is an HTTP request and the client can intercept it and tamper it. If your use case is what you asked, server validation it's not difficult at all. Have a table with all questions and all valid answers, and check every client answer with the table. On the first invalid answer you stop the processing and send back an empty page. the number of possible permutations could make validation very difficult. You have to choose between server-side (from trivial to very difficult) and client side (not possible at all). I believe the choice is easy.
• R

  How to manually connect to my web server and send a TLS handshake with a hostname, followed by the HTTP request headers with a different hostname
  tls apache header handshake • • rosemadder  

  2
  0
  Votes
  2
  Posts
  2
  Views

  G

  The servername tag was the difference. $ openssl s_client -crlf -connect example.com:443 -servername www.example.com GET / HTTP/1.1 Host: example.com [ENTER] Apache 2.4.6: [Sat Mar 05 18:13:23.217568 2022] [ssl:error] [pid 22316] AH02032: Hostname www.example.com provided via SNI and hostname example.com provided via HTTP are different Apache 2.4.52 does not produce this error in the log file. man openssl-s_client
• K

  How might I rate-limit in nginx against a distributed attacker that has set the number of parallel connections in xerxes to 1?
  nginx ddos forensics • • Kadyn  

  2
  0
  Votes
  2
  Posts
  1
  Views

  G

  Does rate-limiting in nginx.conf has any sense in the case of such attack? I'm not sure if the request limiting in nginx can be applied in the first place, since no actual request is sent by the attacker. Instead only a TCP connect is done and a single byte sent, but never a HTTP request. The connection is closed shortly afterwards and a new one is created. In general the capabilities of nginx here are limited since it is designed primarily as a web server and not as DDoS protection system. It can apply some application level limits, like limiting the number of requests per time (which is not the same as the number of TCP connections) or detect https://en.wikipedia.org/wiki/Slowloris_(computer_security) like attacks by requiring the HTTP request to be https://nginx.org/en/docs/http/ngx_http_core_module.html#client_header_timeout . Against the particular attack you mention, TCP level filtering is sufficient though and can be better and with less resources done outside of nginx, for example with iptables. The conntrack and limit modules allow to restrict the number of parallel connections from an IP address and how much new connections can be created within a specific time - see https://unix.stackexchange.com/questions/139285/limit-max-connections-per-ip-address-and-new-connections-per-second-with-iptable .
• K

  Reporting dual sim phone stolen
  gsm imei • • kalyn  

  2
  0
  Votes
  2
  Posts
  1
  Views

  

  Both IMEI numbers have to be barred for the barring to be effective. If you only reported one IMEI, the other won't be barred, and can still register on the network. You can resolve this by contacting the phone company to let them know about the mistake.
• S

  What can an attacker do if they find positive results for `haveibeenpwned`?
  have i been pwned • • simrah  

  2
  0
  Votes
  2
  Posts
  0
  Views

  D

  There's a lot that can be done with that data, that's why it's available for people to check if they were breached so they can act ASAP. Two of the main things an attacker can potentially do are the following: Phishing - An attacker can see that his victim is using a specific application and craft a spear phishing attack. Breached Passwords - While there are a lot of efforts to remove breaches from the internet, it's very hard to get them fully removed. Unfortunately, most of them are accessible really easily by anyone if they just look for it. So yes, there is a lot someone can do with the knowledge of knowing someone was breached with a specific application.
• E

  Can the manufacturer remotely turn off my device?
  account security • • emerson  

  2
  0
  Votes
  2
  Posts
  1
  Views

  J

  Examples of this happening? The Samsung Galaxy phones (I forget which model) that had the bad battery design that kept exploding. Multiple updates were pushed out that, among other things, disabled charging of the battery and eventually that simply shut them down. There was also one that disabled many of their features before this happened. https://duckduckgo.com/?q=exploding+samsung+galaxy+gets+firmware+update+to+stop+charging ALL mobile phones have this "capability" should the manufacturer use it. They make and control the firmware updates sent to each phone. In a way (more by lack of action than by something done), it happens all the time, since the manufacturer usually won't bother to make more than a token few software updates before it gets dropped in favor of the next model or Android version. This means that they become outdated sooner than their actual hardware specifications should imply. I actually know someone with a higher-spec phone than mine running a fairly recent Android who can't run some apps because said app expects Android updates for that version from the last 6 months and the manufacturer already stopped updating it (also, some manufacturers don't usually provide updates that fresh, period). There are also numerous "find my device" apps and utilities baked into many phones, which can certainly do this (that's what they're for). Since this is done through the OS provider, we're forced to trust that said company won't just activate it themselves for some reason (or that some government won't ask them to do it either). As for desktops - it's very possible as well. Many do have "LoJacK" or equivalent enabled, which again has very low-level access to the computer (on some, it's even built into the BIOS rather than the operating system). There are few details available to the public, but it's quite likely that even with it "off" (that is to say, you've never activated it yourself) it can still be used at the option of the manufacturer. Dell, for instance, puts it in the BIOS - https://duckduckgo.com/?q=dell+bios+lojack Making matters worse, Intel, AMD, and ARM produce various "secure" (usually more for the security of media streaming companies via DRM/rootkits-by-any-other-name than security for you) or "management" systems for their CPUs that are used in enterprise-grade machines to monitor, locate, control, and manage said machines. This hardware module has beyond-top-level hardware access over the Internet (it can read your RAM or hard drive without your knowledge or ability to detect, and attempting to completely remove it will cause your computer to shut itself down on its own after a few minutes of usage). Interestingly, this module is also present (but allegedly turned off via software) in every single consumer-grade CPU sold from the former two manufacturers since approximately 2006. I'm not sure about how long ARM has also been doing this, but theirs is present in all smartphone-grade processors produced by them at minimum. Even a lot of their microcontrollers have some version of one of these features. https://github.com/corna/me_cleaner
• A

  Comparing two ways to access home network remotely
  ssh vpn lan • • Anderson  

  2
  0
  Votes
  2
  Posts
  0
  Views

  

  A SSH Server and a VPN Server accomplish two different things. SSH is intended to allow you access to a server. Port forwarding is nice for some resources, but not for everything. If your resources can be accessed by HTTP, SCP or SFTP, they work fine. SMB over SSH performance isn't good, and anything using UDP over SSH will have terrible performance. VPN, on the other hand, will put you inside the local network, so you can access anything as if you where physically there. It's usually more difficult to setup, but gives you better access and better performance. Security-wise, both depend on how you login on the solution you choose. Both SSH with password authentication and VPN with client certificates are very secure. Using fail2ban to secure the system is a good idea. On the other hand, VPN would mean anything compromising your workstation would have full access to your local network, while using SSH it would only mean malware having access to any resource you have port forwarding set.
• 

  Mail gateway allowing telnet connections
  smtp telnet enumeration • • Analeea  

  2
  0
  Votes
  2
  Posts
  0
  Views

  

  I have been told that unauthenticated telnet or similar types of connections to port 25 of our external gateway should be blocked but I don't see a way of this being possible or am I incorrect in saying so. You are right, you can't really run your own mail exchange server and also block port 25 on that server. For example, Google's mail exchangers accept arbitrary telnet connections on port 25, and they allow username enumeration by RCPT TO, and they are doing just fine. For example, Google's mail exchange server at 142.250.141.25 allows connections on port 25 and responds with "550-5.1.1 The email account that you tried to reach does not exist." if the account doesn't exist. And responds with "250 2.1.5 OK" if the account does exist. However, they reject any message that doesn't conform to RFC 5322, and probably do a lot of other anti-spam stuff. Any advice is greatly appreciated. Maybe don't hire this same IT Security Firm again. Or ask them to explain in detail exactly what they mean and exactly what reasonable mitigations could protect against this "vulnerability." But, I think they are probably just giving you a false positive without thinking about it.
• 

  ssh server encrypted key vs password login
  ssh openssh passphrase ssh host key • • briley  

  2
  0
  Votes
  2
  Posts
  0
  Views

  

  Your first example shows a configuration where password authentication is disabled, and key-based authentication is enabled. The second example is the opposite of the first. With regard to 'N': The keys used in key-based authentication would typically have at least 128 bits of entropy. To have an equivalent amount of entropy using a password, the password would need to be randomly generated, and its length (N) would need to be at least 20 characters (possibly more depending on the character set used). See https://security.stackexchange.com/questions/257519/how-many-bits-of-entropy-should-a-password-have-to-be-reasonably-future-proof-1 for more info.
• J

  Can my ISP router, which is set in bridge mode be theoretically hacked or is the risk at the router behind the "modem"?
  network router modem • • Jolied  

  2
  0
  Votes
  2
  Posts
  0
  Views

  T

  It depends on the router. In case of cable routers some run two operating systems on different CPUs. One for the WAN/modem/cable connection like eCos RTOS and one Linux system for the LAN side. On the WAN side there can be an additional network the ISP has access to which you can't see from the LAN. Also a DSL modem still runs some Linux but afaik has no additional network service running on the WAN side. It is similar to a real network bridge. There are usually several other routers from the ISP in your path to the final IP. So you already trust the provider a lot. Your home router could in theory offer some more ways to attack client devices like Wifi, USB or additional applications running on it. Encrypting traffic or using a VPN on your PC/smart phone can protect against a malicious router.
• M

  How do AV interact with malicious executables in remote shares?
  windows antivirus smb • • magpie  

  2
  0
  Votes
  2
  Posts
  1
  Views

  B

  The filesystem is mounted locally on Windows. It is handled mostly just like an internal hard drive so I'd expect an AV to handle this the same as any other malware on a local drive. If in doubt, why not test it?
• J

  Is hivedesk safe?
  remote desktop tracking • • jules  

  2
  0
  Votes
  2
  Posts
  0
  Views

  N

  If someone wouldn't have consented to have this installed many people would call this malware just based on what it does (user activity tracking, geolocation, taking screenshots) To check if it is not running you can look in task manager for related processes or maybe also for programs starting at boot with: https://docs.microsoft.com/en-us/sysinternals/downloads/autoruns
• E

  What sandbox does an <object> element run in? Can this sandbox be configured?
  html web application svg iframe sandbox • • elysha  

  2
  0
  Votes
  2
  Posts
  0
  Views

  K

  When I embed a page using , what can that page do by default? E.g. what cookies can it access? Is it the same as an without the sandbox attribute? Yes (at least in some browsers). The object can access the cookies that are on the same origin that it is included from (but not the origin that includes it). You can test this with a an svg file: which you can include: This will work in firefox (but not in Chrome, which apparently blocks JavaScript in objects; though I'm not sure if this behavior is documented, and I wouldn't rely on it for security purposes). If the data attribute references a different domain, you won't be able to access the cookies of the embedding page (via top or parent; at least in firefox). What are the implications of hosting the user content SVGs on the same domain? Should I instead host them on foobarusercontent.com? Yes, that would restrict the users actions to the origin foobarusercontent.com (which may or may not be appropriate for your use). Does the tag support an equivalent of the sandbox attribute? Is there another way to set permissions for an ? Not as far as I am aware (see also https://developer.mozilla.org/en-US/docs/Web/HTML/Element/object , which doesn't list any relevant tags). What specifications describe the security model for ? I am unaware of a standard for this. Because of this, I would be very careful when embedding user-supplied data into an object. Hosting the data on a designated domain is a good idea. Parsing the data and filtering malicious (javascript-related) tags and attributes would also be good (if acceptable). Do ensure that it is acceptable that users can run JavaScript on that domain (ie no auth cookies; I also wouldn't allow uploading of .js files to the domain, as it would allow installation of serviceworkers, which would allow an attacker to log URLs users visit, and thus possibly disclose (private) files hosted on the domain).
• R

  How to protect yourself from firmware viruses
  malware rootkits firmware • • rosemadder  

  2
  0
  Votes
  2
  Posts
  0
  Views

  A

  In theory every peripheral with a writable firmware (or one which was compromised from the beginning) can be used for storing malware. Many examples have been described in literature or have been presented at some conference. Some like UEFI/Bios or HDD malware have also been observed in the wild. Secure boot will in theory prevent some of those (UEFI) but not all. Also Secure Boot has been bypassed several times. Recent example: https://i.blackhat.com/USA21/Wednesday-Handouts/us-21-Safeguarding-UEFI-Ecosystem-Firmware-Supply-Chain-Is-Hardcoded.pdf The only real mitigation (assuming a non malicious original firmware) is to know the original/known good state of the firmware and have a way to compare it to the current state. This can be very elaborate or next to impossible for the average person depending on the device. The best protection would be to have the firmware write protected at the cost of making updates more complicated.
• J

  activity snooping over SSL by client administrator
  tls • • juvenalb  

  2
  0
  Votes
  2
  Posts
  0
  Views

  O

  A privileged user is able to install some software doing network interception and also add a new trusted root CA. This together makes it possible to do an active MITM attack on the TLS traffic, and thus listen and even modify the traffic. This is similar to what many antivirus products do.
• D

  How to reduce/mitigate the degree to which a Starlink terminal user in a war zone is giving their position in real time?
  wireless satellite starlink • • Duquan  

  2
  0
  Votes
  2
  Posts
  0
  Views

  T

  Starlink terminals are different from your average satellite phone in one important regard: their antenna is directional. It is a phased array. This has two important consequences: The total radio power emitted is less than it would be, should the transmitter be omnidirectional. It is like 2W - comparable to an old-fashioned 2G phone and few times less than Iridium and likes for a great deal more bandwidth. I didn't find easilly available information about the existence of any kind of transmitter power control. It is quite possible (and in general a good engineering practice) that the transmitted power is reduced when the link conditions (satellite position and/or the weather) are favorable. The (averaged) transmit power also depends on the upload data rate. It will be 20-50 times less if the connection is used to download information at the maximum rate (compared to the upload at the maximum rate) and much less when it is lightly used or idle. The emitted radio power is concentrated in a quite narrow beam pointing at some satellite. The beam width is like 1-2 degrees. The same technology that makes it efficient also makes it much less detectable. If the detector is not in or near the beam, it will get orders of magnitude less radio power from the antenna, compared to the ordinary satellite phone. It may as well fail to detect it. I don't know how much sensitive is the military equipment used for this purpose. Either way, the detection is much harder and much more error-prone. Edit: The above is completely true about Starlink terminal V1 (with the circle antenna) when used with wired (Ethernet) connection only and the WiFi disabled or, better yet, the router completely unplugged. V1 is perfectly usable without the bundled-in WiFi router. The white cable from the bundle can be connected to a third-party Ethernet-only router or directly to the computer's Ethernet port. The V2 terminal (with the rectangular antenna) does not have Ethernet capabilities bundled in. It requires an "Ethernet adapter" that is ordered separately. The WiFi router acts as a power supply for the dish, so it cannot be completely and securely unplugged as in V1. I am not aware whether the WiFi can be reliably turned off in the V2 software when only the Ethernet port is used. More comments about radio-securing V2 are welcome. Edit2: Various people on the Internet succeeded in making V2 completely "wired" by cutting the router-side proprietary connector off the cable, crimping an Ethernet RJ-45 plug instead (the cable looks like a beefed-up Ethernet with the usual color scheme) and using a third-party POE injectors with sufficient power rating (aim for 48V, 2A or maybe less with the snow melting function disabled). I don't have V2 available to test, but the idea looks right.
• 

  Implementing geo-location factor for authentication
  authentication gps multi factor geolocation cellular • • Laycee  

  2
  0
  Votes
  2
  Posts
  0
  Views

  R

  Generally, and putting MFA aside, there is a reason why a mobile app requires permission to access location data: it's a massive privacy violation. If every service suddenly could gather this information at will (for whatever reason, including authentication) then each service can physically track the device in space. Breaches in geo-location databases in things like fitness trackers exposed a secret army base. The fitness tracker was tracking multiple military personnel as they ran laps around the base (which was not on any map). Social media posts are advising people in Ukraine to turn off their GPS so gatherings of people cannot be mapped in real-time. So, blindly adding this data collection to a service has very real and serious implications and you need to permit the user to choose to turn this on and off at will. And that weakens it as an authentication factor. Again, more generally, Microsoft AD has had the ability for years to block or limit AD logins based on geo-location. And for some contexts, that can make sense. Especially if all logins were supposed to only occur on the machines in known office locations. But in an increasingly mobile world, it makes less and less sense to be able to limit logins to within 5 metres, as you suggest.
• 

  How does the certificate transparency check in Chrome work?
  tls public key infrastructure certificate transparency • • inna  

  2
  0
  Votes
  2
  Posts
  0
  Views

  R

  The browser generally requires the website to provide an SCT (Signed Certificate Timestamp) signed by the logs which have logged the certificate. This means that while the browser may not immediately verify that the certificate has actually been logged, they still have a promise from multiple log operators that the certificate has been logged. Given chrome's https://googlechrome.github.io/CertificateTransparency/ct_policy.html , it would require the cooperation of at least three rogue entities (one CA and two log operators). While this is not completely ideal, it is significantly better than the previous approach of having a single point of failure. Not all browsers perform SCT auditing as this becomes a significant privacy. However, chrome implements opt-in https://docs.google.com/document/d/1G1Jy8LJgSqJ-B673GnTYIG4b7XRw2ZLtvvSlrqFcl4A/edit where the browsers sends the SCTs it receives to google, which then checks if the certificates have actually been logged.