Information Security: janvier 2015

samedi 31 janvier 2015

Is Java vulnerable to glibc GHOST Vulnerability in Linux?

I see on our RedHat Linux platform that "java" process has dependency over glibc library:


[root@hpproliant1 ~]# ldd /usr/bin/java
linux-gate.so.1 =>  (0xffffe000)
libpthread.so.0 => /lib/libpthread.so.0 (0xf7f77000)
libjli.so => /usr/java/32bit/jre1.6.0_26/bin/../lib/i386/jli/libjli.so (0xf7f6e000)
libdl.so.2 => /lib/libdl.so.2 (0xf7f69000)
libc.so.6 => /lib/libc.so.6 (0xf7e11000)
/lib/ld-linux.so.2 (0xf7f97000)

Does Java APIs call indirectly problematic glibc functions? If so is the jvm using the vulnerable function in a way that's vulnerable?

Is there Information on Payment Gateway Protocol in Korea e-commerce?

Is there Information on Payment Gateway Protocol in Korea e-commerce?

There's many ActiveX programs in Banking and E-Commerce in Korea. So, Almost program runs on IE and MS Windows.

There's some reason, in Korea They use their own spec of Certification and Own Encryption algorithm , named "SEED"

and other closed protocol as I know,

I want to implement that with No additional activeX or Plugin . wholey use Java or JavaScript in Browser side .

Please answer Any Information for implement it.

Thanks in advance.

How to save a web page with its certificate?

I've made a payment to an online store and they're claiming there's no order with the number that appeared in my screen, therefore they're refusing to send me the product. I still have the page opened and I would like to save the entire content of the page in a way that the certificate goes together, so I can prove all that content was generated by them, so I can prove that order number were given to me.

How to do it? I've saved the HTML page already, and the certificate too, but I don't think it'll work. Can I do it in firefox? (the page is already open there).

How to fix common Samsung Galaxy S4 problems

All handsets suffer with problems from time to time and the Samsung Galaxy S4 is no different in this regard. Here's how to fix some of the most common issues.

(This is a preview - click here to read the entire entry.)

Should I takeover a compromised website from another hacker?

A website (www.blue*****art.com) is trying to attack my server using Shell Shock vulnerability. After doing an nmap scan on the attacking IP address, I found many open ports. It looks like the website is running Exim, which is vulnerable to GHOST.

The website in question has not been maintained for the past 3 years (from copyright date, twitter and facebook status), possibly the owner passed away. A check with sucuri shows that it is currently not blacklisted because no malware has been found.

Should I retaliate by taking over the website from the hacker and shutting it down to stop it from scanning other people's computers?

Prevent windows users from logging into, pinging, or browsing other workstations

Bluecoat security did an analysis if the Sony attack and says the following

"This particular sample highlights the value of a network architecture where workstations cannot talk to each. While host-to-host file sharing, and communication can be convenient, it makes lateral movement for an attacker far easier." http://ift.tt/12q7G3y

Does anyone know how this would be accomplished? I want to understand a real world / realistic way this would be done on a medium to very large network?

Scripting some type of powershell script for active directory or via a cisco switch?

Sign java jars for security

We have an enterprise system that utilizes many in house jars, java applications, to run on a centos 7 linux system.

How do I go about achieving the following in order of importance:

Only signed jars can run. If its not signed, I dont want it to run at all.

My jars only run on these systems and no other systems.

I don't mind modifying the jars so that it checks something regarding its environment before running.

Prevent easy decompiling of the java code. (This might be for stackoverflow). But thought Id give it a shot here.

LG G4 vs LG G3: more of the same or dramatically different?

LG's G3 is a great flagship phone, and the next version should be better still. We discover which key features should get significant upgrades in the 2015 flagship.

(This is a preview - click here to read the entire entry.)

Conspicuous changes in the encrypted Truecrypt container [on hold]

I have a backup of my important data in the cloud with a given size of several gigs. To prevent snooping the data is inside a TrueCrypt container and everything which will be transmitted is the TrueCrypt container (no hidden volume).

Because uploading several gigs with even a fast Internet connection is slow, I have split the container file into pieces of several MByte size. I wrote a script which compares the current container with an instance of the past container (The past container is stored on the local disk to speed up the process) and only the changed pieces are written out and finally transmitted to the cloud.

Works great so far. Changes occuring from backup to backup weekly are in the 5% range of the original file, so updating is no problem.

Now a short time ago I prepared the backup and was wondering why it takes so long. I was puzzled to see that the changes have increased from the normal 5% to 50% ! Alarmed, I mounted both volumes (old one and the current one) and made a file compare and could not see any reason for the increase.

I have no knowledge how exactly TrueCrypt lays out the data internally, but as a file system the simple explanation could be that some data is heavily fragmented and deletion/appending such data could cause such an effect.

But I am still uneasy, so

a) Is the simple explanation correct and it is normal that changing only small portions of data could cause changes affecting a much bigger portion of the data in the TrueCrypt container ?

b) If you think a) is not a sufficient reason and you find that it is strange behavior, how to continue ?

ADDITION: There are several misconceptions here, so I will now describe exactly what I am doing because it does not seem "obvious" enough.

I have several gigs of data. And yes, if you have pictures, documents, your source code repository and other important stuff you really want to have again if e.g. your computer is destroyed, then you easily accumulate several gigs.

I want to store the data in a cloud server over webdav. Because I don't want anyone to snoop in my data, I am using encryption and because I do not distinguish between critical confidentiality and...what exactly is the other option ??... so I use TrueCrypt 7.1a.

TrueCrypt offers the option to mount a single big file as virtual drive. The encryption is the Serpent/Twofish chain (no AES). In the meantime I calculated the hash values of the binaries and TrueCrypt seems to be ok, so one possible problem is eliminated (not strictly, but there is hope)

The TrueCrypt volume is mounted, let's say it has the name TC. The first step of the script is started; it compares the content of specific directories (e.g. /foo) to the equivalent TrueCrypt (TC/foo) and updates the TrueCrypt content so that they are equivalent to the original directory. The update uses simply delete/copy and this is the only step where the data is changed. There is no data corruption !

TrueCrypt volume is unmounted. We are looking now at the file used for the virtual drive. It is large and looks random. But because we have changed the content, its binary content has also changed. It is a fact that can be reproduced: If you have committed only small changes in the virtual TrueCrypt drive (at least under Serpent/Twofish) the binary blob normally has only small changes, too.

Now I want to transmit the data as fast as possible. Because the internet connection is a bottleneck, I always have a copy of the old TrueCrypt file. Because I know now that normally only small parts are changed, the big binary Truecrypt file blob is split into smaller segments in the cloud. When changes occur, only the changed segments are then updated. Naturally because the segments have a constant size, I transmit more data than necessary, but it is ok. The cloud is also handled as virtual drive.

So what did I use as file operations ? Essentially delete/copy/remove/binary compare/split. It's not a programming question. It's in my humble opinion neither a "home-growing solution to hack together things that weren't designed to integrate with each other in the first place" and it definitely is not a "business class" or "enterprise" problem. If anyone is not able to write such a script in less an hour him-/herself...

Gilles has asked a very good question. The percentage of changed segments is 50%. I run a counter and found that 20,25% of the binary content has changed with (approximate) sizes

less than 10 bytes: 590 000 times

less than 100 bytes: 5 000 0000 times

less than 1000 bytes: 11 000 000 times

less than 10000 bytes: 350 000 times.

No bigger changes occur.

The number of segments is 320, by the way. The next step for me will be to find long byte chains and see if I can locate them on another place (so that my suspicion that it isn't change, only relocation, is confirmed).

I do not know the exact security implications, but if some operations on TrueCrypt files can trigger a large change in the data contained when normally only small changes are observed, it could be a possible weakness.

When, during authentication, should I ask for an OTP token?

I was working on implementing an OTP strategy in our login process of a web application when I was asking myself: Should I ask for the OTP token before or after asking for the username/password?

What I generally see with services I use is, I have to provide the OTP token after they've verified my username/password.

I was wondering if this was just due to user experience decisions or if there was a security aspect to it.

MobileIron traffic interception

I am trying to do a security checks for a BYOD android app based Mobile@Work, but I can not intercept,even capture the traffic with fiddler(can intercept).

I have try:

if I change my wifi proxy to the one not exist,this app is the only one access the internet.

with wireshark monitoring the traffic, the app access the internet with tcp.

then,I installed droidproxy app ,and set the proxy (point to fiddler running on my laptop, proxy type is "HTTP" ),the fiddler showed the traffic and alert "the remote server(x.x.x.x) presented a certificate that did not validate, due to RemoteCertificateNameMismatch,RemoteCertificateChainErrors"

any methods to intercept the traffic without error mentioned above? pls help.

Is it possible to get kmail to work with (suspected) Google OAuth 2.0

Just clicked the improved security button in Gmail, now kmail cannot access imap ... is there a work around and keep the better security?.

Current standard of authentification

What is the current standard of authentification?

I thought it is server and client authentification.

But I typed for e.g. https://www.google.com/ and checked the packages in wireshark. And there is only a server authentification. I am wondering why the server is never sending me the TLS CertificateRequest-message (Isn't it the only way how client-authentification can be accomplished?).

Shouldn't that be standard and why why should a HTTPS-Webserver trust me? (Retrieving a certificate from a common CA should be easy for my webbrowser)

Major problems binding IP, in Kali's `Social Engineering Toolkit`

So, I'm attempting to set up a virtual network, one VM for Kali Linux, and one VM for Windows 7. The Kali VM is used for penetration testing, hacking, etc, all on the windows VM. I am using Oracle's VirtualBox Virtual Machine application. This is the order I am taking in order to remote control the Windows VM:

Open setoolkit

Social-Engineering Attacks

Create a Payload and Listener

Enter the IP (10.0.3.15 the IP that shows up when doing ipconfig in windows)

Windows Reverse_TCP Meterpreter

Backdoor Exectuable

Default Port

Begin listener (yes)

MFC Starts

I received no error, I was happy. Then when I transfered the payloader.exe to the windows VM, and ran it, nothing happened. I checked the Kali IP (ifconfig) to find out that it was the same IP - 10.0.3.15. So I ended up with 2 VMs on the same IP.

When I tried to change the IP on the windows system, I was getting the error Handler failed to bind to (IP).

This is the network setup in my VirtualBox:

enter image description here

What do I do about a forgotten, ancient PGP key?

So I just created a new PGP key because I want to start using PGP to encrypt my emails. Lo and behold, this is apparently not my first attempt to use PGP. Five years ago, I created another PGP key using an ancient encryption algorithm (DSA 1024-bit). This would be very easy to crack.

Needless to say, I don't have a revoke certificate for it. What should I do?

Website infected with unwanted "redirections", apparently via javascript code

I'm working on a clients website, and I realize they've been compromised. Early today there was a major problem with a php eval(base64_decode issue. That was cleaned up via Andy Stratton clean.php repair (which searches for infected files and then deletes them.) Website was rebuilt with virgin Wordpress code and a trusted theme. 12 hours later I'm seeing lots of unwanted redirects. The redirects are going to an odd site overseas somewhere. In fact, redirects may not be the correct term. I can see all of the original sites content loading up in the developer tools, and at the end of the load it grabs an image and a music player, and pastes up a simple html page. The image is http://ift.tt/1velH2t The displayed url was the original selected on the site.

enter image description here

As I do just a bit of testing, I find that the issue seems to be related to JavaScript. If I turn off the JS, no redirects. Here are my questions: Can I use the JS tools in Chrome to identify which file is most suspect? (pause on exceptions, etc.. ) Is there any way to scan all the files to look for evil JS code? I've tried the common tools & locations to review, with no avail. Its definitely not a .htaccess issue.

I'm very curious if I might be able to step thru the JavaScript code in Chrome and see where things go astray. I suspect the fix for this is to wipe the VPS and reinstall, but in the mean time, I'm curious. Can I detect where the evil code is located?

And note, I don't have complete access to the server. I only have simple cPanel & FTP access. Additionally the site is being served thru CloudFlare. Many thanks for your help.

Update: We've figured out where the errant code was located..It was in the mySQL database in a cell normally reserved for widget content. The code was quite large, 1530 lines of gobbledy gook. Some words in the clear, others in cryptic code. Its heavily obfuscated with code with : and ; elements. Apparently this customer has been hit before, their current web guy wants to throw bandaids at the site. I think I've convinced the business owner to put his business elsewhere, and secure up everything.

One question. Because the Database is compromised, is there a safe way to clone the site on a new server? I guess I can search the DB for familiar patterns based on this one block of code, but that really isn't robust. I know I can create a content XML backup from the admin control panel --> Export. The format is actually called WordPress eXtended RSS or WXR, and it will contain posts, pages, comments, custom fields, categories, and tags. I can review those entries visually, to see if things make sense.

Any other ideas on cloning a site with at least one virus in the DB??

Also, Is there a repository for legitimate folks chasing down viruses' for submitting this example of recent JavaScript activity? Obviously I'm not going to post it here, to avoid giving others a chance to create more. e.g. do I submit the code to folks like sucuri.net or somewhere else?

What are some IP camera server software solutions? [on hold]

I'm looking at installing some IP cameras at a church campus with several buildings. Right now I'm looking at picking some NVR (network video recorder) software. Most things I'm finding are aimed for the home, I've not found a good list of software more aimed for businesses.

Criteria: Must be scalable to at least 32 cameras. Must be either linux or Windows based.

How can I determine whether or not a POS terminal violates requirements in the PCI DSS?

The business I work for uses an Equinox Optimum T4220 (hardware number 060001) in dial-out mode. I see two search results1 for "T4220" listed on the PCI SSC's website under Approved PIN Transaction Security (PTS) Devices2. These listings look similar to what we have, but

come from other manufacturers

have a hardware number in the 0630xx and up

I would like to determine whether or not this terminal violates the PCI DSS's requirements on storing cardholder data. I am concerned with requirements 3.2.1, 3.2.2, 3.2.3, and 3.4.

I am also concerned with cryptography and transmission as I have no way to detect violation of these rules either.

How can I determine whether or not a POS terminal negatively impacts this business' attempt to become compliant with the PCI DSS?

How can I encrypt Kali Linux after the install?

Okay so here is some useful background before we get started. I booted a Windows 7 install disk, split the hard drive into two partitions, installed windows. Rebooted, installed Kali, then booted into Windows and encrypted the Windows partition with PGP Desktop.

When I power on I have to enter my PGP pass phrase then it loads grub and from there I can choose between Windows and Kali. While in Kali I can tell Windows is encrypted.

During the Kali install I did not choose to encrypt, So my question is: How do I encrypt Kali without re-installing. A terminal command would be nice.

FTP over SSL vs HTTPS implemention

Consider two implementations of SSL on a HTTP server and on an FTP server. With the same cipher suites used and the exact same protocols used.

Is one more secure than the other. I have heard that it is difficult to get FTP to downgrade protocols. So is the implementation of SSL onto FTP more secure than through FTP?

Chrome/Youtube says incorrect certificate for host?

Why my Youtube always ask me: Incorrect certificate for host. The server presented a certificate that doesn't match built-in expectations. These expectations are included for certain, high-security web sites in order to protect you. Error 150 (net::ERR_SSL_PINNED_KEY_NOT_IN_CERT_CHAIN): The server's certificate appears to be a forgery. How can I solve it?

Digital signatures and weak hash functions

There was this question in last year's exam, which I'm not totally sure I would have answered correctly (the answer b), which is supposed to be correct is bolded):

Attacks are constantly being performed on digital signatures which use weak hash functions (e.g. MD5). When an exploit of a hash algorithm is found,...:

a) all the signed documents are equally exposed.

b) the newly signed documents are more exposed.

c) the older documents are more exposed.

d) the older documents are a little more exposed.

Upon reading the question I first would have went with answer a), since I don't know what time has to do with a vulnerability in a hash function. But then I thought maybe it has something to do with the expiration date of the involved certificates (and public keys). It this why b) is, supposedly, the correct answer?

Thank you in advance.

Best Android apps of 2015

Deciding which apps to download is a daunting task. Check out our list of the best Android apps to download in 2015 for your phone or tablet.

(This is a preview - click here to read the entire entry.)

Timestamp authority - user/pass authentication

I want to run a Time stamp authority server. I found two projects: PrimeKey signserver and TSA: http://ift.tt/1ClwaLv

Why these TSA servers doesn't have user/pass authentication?

Browser Fuzzing

Basically I want to get Started with Browser Fuzzing Which Fuzzing Framework is best option to reproduce the CRASH out of the B0x Any leads such as Whitepapers or Tutorials etc? i did google a bit came to know that RADAMSA and Grinder can be effectively but still confused any leads is greatly welcomed. I also came across called "Hybrid Fuzzing Framework" still want to what is that too.

Thank you for your time

How to compare passwords with duplicate password

On Steam, the gaming client, I have this habit of creating multiple "smurf" accounts.

I have a randomly-generated, unique password, and I decided to use the same password for all of my multiple accounts. On my fifth account or so, Steam has started preventing me from using the same password again.

How does Steam know whether a password has been used before without compromising my security?

Spam from sendmail

Today my sendmail service started sending e-mail to various addresses.

/var/spool/mail:


From MAILER-DAEMON@noxcommunity.com  Fri Jan 30 22:15:30 2015
Return-Path: <MAILER-DAEMON@noxcommunity.com>
Received: from localhost (localhost)
    by noxcommunity.com (8.13.8/8.13.8) id t0ULFUje031918;
    Fri, 30 Jan 2015 22:15:30 +0100
Date: Fri, 30 Jan 2015 22:15:30 +0100
From: Mail Delivery Subsystem <MAILER-DAEMON@noxcommunity.com>
Message-Id: <201501302115.t0ULFUje031918@noxcommunity.com>
To: postmaster@noxcommunity.com
MIME-Version: 1.0
Content-Type: multipart/report; report-type=delivery-status;
    boundary="t0ULFUje031918.1422652530/noxcommunity.com"
Subject: Postmaster notify: see transcript for details
Auto-Submitted: auto-generated (postmaster-notification)

This is a MIME-encapsulated message

--t0ULFUje031918.1422652530/noxcommunity.com

The original message was received at Fri, 30 Jan 2015 22:15:30 +0100
from localhost.localdomain [127.0.0.1]
with id t0ULFUje031916

   ----- The following addresses had permanent fatal errors -----
<s@s>
    (reason: 550 Host unknown)

   ----- Transcript of session follows -----
550 5.1.2 <s@s>... Host unknown (Name server: s: host not found)
550 5.1.1 <noreply@noxcommunity.com>... User unknown

--t0ULFUje031918.1422652530/noxcommunity.com
Content-Type: message/delivery-status

Reporting-MTA: dns; noxcommunity.com
Received-From-MTA: DNS; localhost.localdomain
Arrival-Date: Fri, 30 Jan 2015 22:15:30 +0100

Final-Recipient: RFC822; s@s
Action: failed
Status: 5.1.2
Remote-MTA: DNS; s
Diagnostic-Code: SMTP; 550 Host unknown
Last-Attempt-Date: Fri, 30 Jan 2015 22:15:30 +0100

--t0ULFUje031918.1422652530/noxcommunity.com
Content-Type: message/rfc822

Return-Path: <noreply@noxcommunity.com>
Received: from noxcommunity.com (localhost.localdomain [127.0.0.1])
    by noxcommunity.com (8.13.8/8.13.8) with ESMTP id t0ULFUje031916
    for <s@s>; Fri, 30 Jan 2015 22:15:30 +0100
Received: (from root@localhost)
    by noxcommunity.com (8.13.8/8.13.8/Submit) id t0ULFUNT031915;
    Fri, 30 Jan 2015 22:15:30 +0100
Date: Fri, 30 Jan 2015 22:15:30 +0100
Message-Id: <201501302115.t0ULFUNT031915@noxcommunity.com>
To: s@s
Subject: Facebook
X-PHP-Originating-Script: 0:eb.php
From: "notification@facebookmail.com" <noreply@facebookmail.com>
Content-Type: text/html

<html>
<head>
<style><!--
.hmmessage P
{
margin:0px;
padding:0px
}
body.hmmessage
{
font-size: 10pt;
font-family:Tahoma
}
--></style>
</head>
<body class='hmmessage'>
<meta http-equiv="Content-Type" content="text/html; charset=unicode">
<meta name="Generator" content="Microsoft SafeHTML"><title>Message body</title><bgsound src="http://ift.tt/1CX2iny"></bgsound><table width="98%" border="0" cellspacing="0" cellpadding="40"><tbody><tr><td bgcolor="#f7f7f7" width="100%" style="font-family:'lucida grande', tahoma, verdana, arial, sans-serif"><table cellpadding="0" cellspacing="0" border="0" width="620"><tbody><tr><td style="background:#3b5998;color:#FFFFFF;font-weight:bold;font-family:'lucida grande', tahoma, verdana, arial, sans-serif;padding:4px 8px;vertical-align:middle;font-size:16px;letter-spacing:-0.03em;text-align:left"><a style="color:#FFFFFF;text-decoration:none" href="http://goo.gl/QdWtIJ" target="_blank"><span style="color:#FFFFFF">facebook</span></a></td><td style="background:#3b5998;color:#FFFFFF;font-weight:bold;font-family:'lucida grande', tahoma, verdana, arial, sans-serif;padding:4px 8px;vertical-align:middle;font-size:11px;text-align:right"></td></tr><tr><td colspan="2" style="background-color:#FFFFFF;border-bottom:1px solid #3b5998;border-left:1px solid #CCCCCC;border-right:1px solid #CCCCCC;font-family:'lucida grande', tahoma, verdana, arial, sans-serif;padding:15px" valign="top"><table width="100%"><tbody><tr><td width="470px" style="font-size:12px" valign="top" align="left"><div style="margin-bottom:15px;font-size:12px"></div><div style="margin-bottom:15px"><span style="color:#111111;font-size:14px;font-weight:bold;">A friend tagged you in a photo</span></div><div style="margin-bottom:15px"><div style="border-bottom:1px solid #ccc;line-height:5px">&nbsp;</div><br><table cellspacing="0" cellpadding="0" style="border-collapse:collapse"><tbody><tr><td style="padding:5px"></td></tr><tr><td width="150" style="font-size:11px;font-family:'lucida grande', tahoma, verdana, arial, sans-serif;padding:0px 5px 10px 0px"><table cellspacing="0" cellpadding="0" style="border-collapse:collapse"><tbody><tr><td valign="top" style="padding-right:5px"><a href="http://goo.gl/QdWtIJ" style="col!
 or:#3b59
98;text-decoration:none" target="_blank"><img style="border:0px none" alt="Chris Thomas" src="http://ift.tt/1BI1XmV" width="50" height="50"></a></td><td valign="top"><span style="font-size:11px;color:#999;padding:0px 0px 10px 0px"><span style="font-size:11px;color:#3B5998;font-weight:bold"><a href="http://goo.gl/QdWtIJ" style="color:#3B5998;text-decoration:none;font-size:11px" target="_blank">Chris Thomas</a></span><br></span></td></tr></tbody></table></td></tr></tbody></table><div style="border-bottom:1px solid #ccc;line-height:5px">&nbsp;</div><br></div><div style="margin-bottom:15px">Thanks,<br>
The Facebook Team</div></td><td valign="top" width="150" style="padding-left:15px" align="left"><table cellspacing="0" cellpadding="0" style="border-collapse:collapse"><tbody><tr><td style="padding:10px;background-color:#fff9d7;border-left:1px solid #e2c822;border-right:1px solid #e2c822;border-top:1px solid #e2c822;border-bottom:1px solid #e2c822"><div style="margin-bottom:15px;font-size:12px"></div><table cellspacing="0" cellpadding="0" style="border-collapse:collapse"><tbody><tr><td style="border-width:1px;border-style:solid;border-color:#3b6e22 #3b6e22 #2c5115;background-color:#69a74e"><table cellspacing="0" cellpadding="0" style="border-collapse:collapse"><tbody><tr><td style="font-size:11px;font-family:'lucida grande', tahoma, verdana, arial, sans-serif;padding:4px 10px 5px;border-top:1px solid #95bf82"><a href="http://goo.gl/QdWtIJ" style="color:#fff;text-decoration:none;font-weight:bold;font-size:13px" target="_blank">View photo</a></td></tr></tbody></table></td></tr></tbody></table></td></tr></tbody></table></td></tr></tbody></table><br><table cellspacing="0" cellpadding="0" style="border-collapse:collapse;width:100%"><tbody><tr><td style="padding:10px;background-color:#fff9d7;border-left:1px solid #e2c822;border-right:1px solid #e2c822;border-top:1px solid #e2c822;border-bottom:1px solid #e2c822"><div style="font-weight:bold;margin-bottom:2px;font-size:11px">To view this friend profile photo, go to:</div><a href="http://goo.gl/QdWtIJ" style="color:#3b5998;text-decoration:none;font-size:11px" target="_blank">http://ift.tt/1CX2jIh style=""><img src="http://ift.tt/1BI1XmZ" style="border:0;width:1px;height:1px"><bgsound src="http://ift.tt/1CX2jIl"></bgsound></span></td></tr><tr><td colspan="2" style="color:#999999;padding:10px;font-size:12p!
 x;font-f
amily:'lucida grande', tahoma, verdana, arial, sans-serif">If you don't want to receive these emails from Facebook in the future, please follow the link below to unsubscribe.
http://ift.tt/1CX2jIn
Facebook, Inc. P.O. Box 10005, Palo Alto, CA 94303</td></tr></tbody></table></td></tr></tbody></table>                    </body>
</html>

maillog:


Jan 30 22:15:30 vm2745 sendmail[31911]: t0ULFTv1031911: to=geoxnox@gmail.com, delay=00:00:01, xdelay=00:00:01, mailer=relay, pri=35539, relay=[127.0.0.1] [127.0.0.1], dsn=2.0.0, stat=Sent (t0ULFTVJ031912 Message accepted for delivery)
Jan 30 22:15:30 vm2745 sendmail[31915]: t0ULFUNT031915: from=noreply@noxcommunity.com, size=5525, class=0, nrcpts=1, msgid=<201501302115.t0ULFUNT031915@noxcommunity.com>, relay=root@localhost
Jan 30 22:15:30 vm2745 sendmail[31916]: t0ULFUje031916: from=<noreply@noxcommunity.com>, size=5760, class=0, nrcpts=1, msgid=<201501302115.t0ULFUNT031915@noxcommunity.com>, proto=ESMTP, daemon=MTA, relay=localhost.localdomain [127.0.0.1]
Jan 30 22:15:30 vm2745 sendmail[31915]: t0ULFUNT031915: to=s@s, delay=00:00:00, xdelay=00:00:00, mailer=relay, pri=35525, relay=[127.0.0.1] [127.0.0.1], dsn=2.0.0, stat=Sent (t0ULFUje031916 Message accepted for delivery)
Jan 30 22:15:30 vm2745 sendmail[31918]: t0ULFUje031916: to=<s@s>, delay=00:00:00, xdelay=00:00:00, mailer=esmtp, pri=125760, relay=s, dsn=5.1.2, stat=Host unknown (Name server: s: host not found)
Jan 30 22:15:30 vm2745 sendmail[31918]: t0ULFUje031916: to=<noreply@noxcommunity.com>, delay=00:00:00, mailer=local, pri=125760, dsn=5.1.1, stat=User unknown
Jan 30 22:15:30 vm2745 sendmail[31918]: t0ULFUje031916: t0ULFUje031918: postmaster notify: User unknown
Jan 30 22:15:30 vm2745 sendmail[31914]: STARTTLS=client, relay=gmail-smtp-in.l.google.com., version=TLSv1/SSLv3, verify=FAIL, cipher=RC4-SHA, bits=128/128
Jan 30 22:15:30 vm2745 sendmail[31918]: t0ULFUje031918: to=root, delay=00:00:00, xdelay=00:00:00, mailer=local, pri=36970, dsn=2.0.0, stat=Sent
Jan 30 22:15:30 vm2745 sendmail[31919]: t0ULFUFv031919: from=noreply@noxcommunity.com, size=5525, class=0, nrcpts=1, msgid=<201501302115.t0ULFUFv031919@noxcommunity.com>, relay=root@localhost
Jan 30 22:15:30 vm2745 sendmail[31914]: t0ULFTVJ031912: to=<geoxnox@gmail.com>, delay=00:00:00, xdelay=00:00:00, mailer=esmtp, pri=125774, relay=gmail-smtp-in.l.google.com. [74.125.136.26], dsn=5.0.0, stat=Service unavailable
Jan 30 22:15:30 vm2745 sendmail[31914]: t0ULFTVJ031912: to=<noreply@noxcommunity.com>, delay=00:00:00, mailer=local, pri=125774, dsn=5.1.1, stat=User unknown
Jan 30 22:15:30 vm2745 sendmail[31914]: t0ULFTVJ031912: t0ULFUVJ031914: postmaster notify: User unknown
Jan 30 22:15:30 vm2745 sendmail[31910]: STARTTLS=client, relay=mta5.am0.yahoodns.net., version=TLSv1/SSLv3, verify=FAIL, cipher=RC4-SHA, bits=128/128
Jan 30 22:15:30 vm2745 sendmail[31921]: t0ULFUrk031921: from=<noreply@noxcommunity.com>, size=5760, class=0, nrcpts=1, msgid=<201501302115.t0ULFUFv031919@noxcommunity.com>, proto=ESMTP, daemon=MTA, relay=localhost.localdomain [127.0.0.1]
Jan 30 22:15:31 vm2745 sendmail[31914]: t0ULFUVJ031914: to=root, delay=00:00:01, xdelay=00:00:00, mailer=local, pri=36998, dsn=2.0.0, stat=Sent
Jan 30 22:15:31 vm2745 sendmail[31919]: t0ULFUFv031919: to=s@s, delay=00:00:01, xdelay=00:00:01, mailer=relay, pri=35525, relay=[127.0.0.1] [127.0.0.1], dsn=2.0.0, stat=Sent (t0ULFUrk031921 Message accepted for delivery)
Jan 30 22:15:31 vm2745 sendmail[31924]: t0ULFUrk031921: to=<s@s>, delay=00:00:01, xdelay=00:00:00, mailer=esmtp, pri=125760, relay=s, dsn=5.1.2, stat=Host unknown (Name server: s: host not found)
Jan 30 22:15:31 vm2745 sendmail[31924]: t0ULFUrk031921: to=<noreply@noxcommunity.com>, delay=00:00:01, mailer=local, pri=125760, dsn=5.1.1, stat=User unknown
Jan 30 22:15:31 vm2745 sendmail[31924]: t0ULFUrk031921: t0ULFVrk031924: postmaster notify: User unknown
Jan 30 22:15:31 vm2745 sendmail[31924]: t0ULFVrk031924: to=root, delay=00:00:00, xdelay=00:00:00, mailer=local, pri=36970, dsn=2.0.0, stat=Sent
Jan 30 22:15:33 vm2745 sendmail[31910]: t0ULFT2n031908: to=<seffarachef@yahoo.com>, delay=00:00:04, xdelay=00:00:04, mailer=esmtp, pri=125778, relay=mta5.am0.yahoodns.net. [98.138.112.38], dsn=5.0.0, stat=Service unavailable
Jan 30 22:15:33 vm2745 sendmail[31910]: t0ULFT2n031908: to=<noreply@noxcommunity.com>, delay=00:00:04, mailer=local, pri=125778, dsn=5.1.1, stat=User unknown
Jan 30 22:15:33 vm2745 sendmail[31910]: t0ULFT2n031908: t0ULFX2n031910: postmaster notify: User unknown
Jan 30 22:15:33 vm2745 sendmail[31910]: t0ULFX2n031910: to=root, delay=00:00:00, xdelay=00:00:00, mailer=local, pri=37006, dsn=2.0.0, stat=Sent

And similar e-mails go on almost every second.

I am totally baffled about this, what's causing it?

Security OpenVZ vs LXC

For years, I'm now using OpenVZ on my server, but support discontinued for Debian and Ubuntu, current releases seem to focus on LXC now, which is not a bad idea from the point of comfort.

But what about security? I remember I read once that LXC doesn't provide the same level of process and container separation than OpenVZ does. Unfortunately, I cant find the document anymore, but I agree there might be some security issues at least in the default configuration of LXC. For example, with a completely customized rootfs I managed once (in an older version of LXC) to change the host's terminal from an LXC container using chvt 1 and pressing Ctrl+C ended in a restart of my X11 environment when I tried to reproduce it today. I know, all container solutions use the same kernel and a kernel hack can lead to a container breakout, that's not what I ask. But it shouldn't be that easy to influence the host or other containers from a container.

How much security can I expect from OpenVZ and LXC?

My server exposes some guest ports to the internet, so I really care about this aspect, but I have to make a decision because the currently used tools need to be upgraded. Using LXC or similar is not an option since my server has a low-performance CPU.

PS: I'm speaking about the real OpenVZ implementation with vzctl 4.7.2-1. Some newer implementations of vzctl use LXC techniques.

Crafted jpg and exploit

I use Ubuntu and last firefox version.

I have opened an image with firefox, and a crash occurred.

Let's assume it's a crafted jpg to run an exploit, and execute arbitrary code.

Is such code runnable for every OS ?

Or it can't be universal ? So only valid for windows for instance.

Thank you

Overcoming sanitize filters for SQL injection in a php app

I'm learning ethical hacking and now I'm on sql injection topic. I'm also new to SQL and php. Ok, so I have local vulnerable website with back-end Linux, PHP, MySQL and Apache. I'm practicing SQL injection with login, password forgotten reset, and profile status update text PHP functions. Now, all of the mentioned functions use a common set of sanitize filter functions in order to prevent SQL injections. So far I've managed to use sql injection to login, but attempts with sql injecting the profile status update and password reset functions have failed. So, I need some help in understanding the sanitize function filters and finding a way to overcome them. I especially look forward to exploit the profile text update to inject sql to return interesting tables and or even updating or doping them. Ok, here are the functions that sanitize SQL input:


function sanitizeStr($var)
{
global $connection;
$var = strip_tags($var);
$var = htmlentities($var);
$var = stripslashes($var);
return $connection->real_escape_string($var);
}

function sanitizeStrSQ1($var)
{
return ($var);
}

function sanitizeStrSQ2($var)
{
global $connection;
return $connection->real_escape_string($var);
}

function sanitizeStrXSS51($var)
{
global $connection;
return $connection->real_escape_string($var);
}

function sanitizeStrXSS52($var)
{
global $connection;
$var = str_replace('<script>', '', ($var));
return $connection->real_escape_string($var);
}

Is any hash function available with predefined length

I need to have a hash function in matlab which has capability to define its generated hashing length. For example, MD5 can generated hashing with length of 128 bits. However, I need to define various hashing function with designed lengths such as 10,16,20, ...

From iPhone to Android: good reasons to switch

Wondering why you should switch over to Android from iOS? Check out some of our best reasons in our comprehensive list and maybe see why Android is the right choice.

(This is a preview - click here to read the entire entry.)

Why is it dangerous when an attacker can control the `n` parameter to `memcpy()`?

I was reading a paper and saw this piece of code has an information leakage vulnerability. It was saying the following code will Leak memory layout information to the attackers

Could somebody please explain me how this leaks information?


struct userInfo{
    char username[16];
    void* (*printName)(char*);
} user;
...
user.printName = publicFunction.
...
n = attacker_controllable_value; //20
memcpy(buf, user.username, n);   //get function ptr
SendToServer(buf);

I can see memcpy will give exception but why should it return memory address to attacker(or whatever it is returning)?

Thanks in advance

Could a fake tip that my server is compromised be a social engineering attack?

A little while ago I got the following email from an unknown party (using an @alum.cs.[redacted].edu email address):

I'm seeing attack traffic from your Linode. Just a friendly heads up that its likely p0wned. A quick google suggests no one else likes the traffic coming from your Linode either.

<http://ift.tt/1CWDLPv Linode's IP]>

However I couldn't find any evidence to support this assertion. I checked the resource utilization graphs provided by Linode, as well as my firewall logs, system's process list, active connections, recently modified files, user accounts, and so on, and found absolutely no anomalies. The results from the Google search didn't seem to back up the claim that nobody else likes the traffic either; nothing I saw in the first few results raised any red flags. So either the server is fine, or I'm dealing with an adversary who knows how to cover their tracks so well that I can't imagine why they would have any interest in my Linode. (There is no sensitive data on it.)

This leads me to wonder whether the message could have been a form of phishing. In this particular case, I doubt it, but could something like this be a legitimate social engineering tactic? Is there something I would be likely to reveal by replying to this message which could be used against me in some way I can't think of?

If and when this happens in the future, my goal is to respond in a way that allows me to collect the information I need to track down the attack in case it is real, while not revealing anything too compromising in case it isn't real.

Does "Magic Numbers" weaken encryption?

I was wandering at superuser and I found this question: Compress and then encrypt, or vice-versa?

Nearly all files have a Magic Number at a certain position in them. So, I wonder if I can attack (to break encryption or reduce possiblities...) by guessing several popular file formats?

I am aware that my question is very general without mentioning any encryption method or file format but I'm also looking for a general answer.

Thanks!

Is the convertomp3.com website hacked? :)

I wanted to convert a youtube video to mp3, but the website gaved me an EXE?

http://ift.tt/1uLIzk1

http://ift.tt/1vjIx8K

vendredi 30 janvier 2015

Secure personal finance software

i am in need if a secure personal finance software to keep track of spendings etc. and i wonder if there you guys have some recommendations. I am also interested in best practices.

As of now i have my finances stored in an excel sheet on an encrypted drive. It is pretty inconvenient.

Best Regards,

win

DES-CBC: Two ciphertext blocks c2 and c5 are equal. Why would this leak information?

Here, suppose that we were able to observe the ciphertext that we know had been encrypted in CBC mode, then how knowing of c2 and c5 ciphertext blocks would leak information ?

My professor asked us in the class and told us to think about it and gave us hint what would happen if we knew one of the plaintext blocks m2?

How to protect against adversaries snatching booted laptops to defeat full disk encryption?

I read an article describing how FBI agents snatched Ross Ulbricht's laptop while it was running to defeat full-disk encryption:

Two plainclothes FBI agents, one male and one female, walked up behind Ulbricht and began arguing loudly. This staged lovers' tiff caught Ulbricht's attention long enough to distract him from his laptop. As soon as Ulbricht looked up, the male agent reached down and slid the computer over to his female colleague, who quickly snatched it up and handed it over to Kiernan for further investigation.

Ideally, one would only operate computers from places that are more physically secure than a public library, but that is not always practical in the real world.

I imagine that journalists working in dangerous places and other well-meaning people are also vulnerable to the theft of running laptops (thus defeating full-disk encryption), and I would like to figure out how to help them.

What kind of security measures can protect the data on a running laptop being physically snatched?

How should I deal with adware in chrome on ubuntu?

I use chrome (but also have firefox) on ubuntu 14.04 32-bit. Recently I started getting popups from 'softwareupdaterlp.com'. I had the sense to realize it was not legitimate and I didn't click install or anything, but I'm worried it might cause problems on my system.

In an attempt to fix the problem I reset all settings on chrome and restarted my computer. My question is - was that an appropriate reaction? Do I need to go further and install AV software/take additional steps or am I ok?

Sign PKCS#7 and verify PKCS#7 signature with OpenSSL

If someone have to transfer X.509 certificates in a single bundle, usually, it is recommended to pack them into PKCS#7. And content of PKCS#7 can be signed.

OpenSSL allows to pack certificates into PKCS#7 in the following way:

openssl crl2pkcs7 -nocrl -certfile domain.crt -certfile ca-chain.crt -out domain.p7b

As I understand from the man page of 'openssl crl2pkcs7', this PKCS#7 is signed:

The output file is a PKCS#7 signed data structure containing no signers and just certificates and an optional CRL.

A few questions here:

What does 'containing no signers' mean?

If the content (certificates) of PKCS#7 is not really signed, how can it be done using OpenSSL?

How signature of PKCS#7 can be verified using OpenSSL considering that it was signed?

If I understand overall concept wrongly, please, clarify that.

Encrypt database records to be accessed by multiple users

I want to encrypt serialised customer details and store in a database to protect against attacks where the attacker has access to the raw database records. The records then need to be accessible by multiple logged-in users, but do not need to be indexed nor searched.

The naive approach would be to use a system-wide key for symmetrical encryption using AES or similar, however I'm not sure that this is any more secure than no encryption at all.

Is it generally safe to say that raw DB access is more of a threat than source code access? Assuming so (which I believe to be the case in my situation), is there a better approach that I can use than one system-wide key?

Thanks

Ethical hacking. Learning SQL injection with php login form

I'm learning ethical hacking and now I'm on sql injection topic. I'm also new to SQL and php. Ok, so I have local damn vulnerable website with back-end Linux, MySQL and Apache and now trying to use sql injection to login. The login form is php script, the login page consists of 2 boxes: username and password. I tried adding the "'" sign at the end of password and i do get sql error, so it is probably injectable. Then I tried adding the "' OR 1=1" and "' OR 'a'=a'" at the end of the password, but with not much success. So now I need some help! Any ideas or suggestions will be helpful. The php login code is below:


<?php

require_once 'header.php';
echo "<div class='main'><h3>Please enter your details to log in</h3>";

$error = $user = $pass = "";

// Sanitization is present

if (isset($_POST['user']))
{
$user = sanitizeString($_POST['user']);
$pass = sanitizeStringSQL1($_POST['pass']);

if ($user == "" || $pass == "")
$error = "Not all fields were entered<br>";

else
{
$result = queryMySQL("SELECT user,pass FROM members WHERE user='$user' AND pass='$pass'");
if ($result->num_rows == 0)
{
$error = "<span class='error'>Username/Password invalid</span><br><br>";
}

else
{
$_SESSION['user'] = $user;
$_SESSION['pass'] = $pass;
die("You are now logged in. Please <a href='members.php?view=$user'>" . "click here</a> to continue.<br><br>");
}
}
}

echo <<<_END
<form method='post' action='login.php'>$error
<span class='fieldname'>Username</span><input type='text'
maxlength='16' name='user' value='$user'><br>
<span class='fieldname'>Password</span><input type='password'
maxlength='16' name='pass' value='$pass'>
_END;

// End of dummy login.php

?>

<br>

<span class='fieldname'>&nbsp;</span>
<input type='submit' value='Login'>
</form><br></div>
</body>
</html>

Best Boost Mobile phone plans: Data Boost - what's the big deal?

Boost Mobile's Data Boost tariffs promise to be the cheapest way to get stacks of 4G data plus unlimited talking and texting. How do they compare to rivals' offers?

(This is a preview - click here to read the entire entry.)

Best cloud storage apps for Android: 6 beauties sent from above

SD cards and internal memory are out, cloud storage is in. Make sure you only download the best cloud storage apps on Android with our list of cloud services.

(This is a preview - click here to read the entire entry.)

Any way to revoke old key pair?

There is a many-year-old 1024 DSA key in the public keyservers under my name. There is a 2048 ELG-E subkey for it. I didn't create these keys, they were created for me by a former employer without my consent. I don't have the private key and it apparently has no expiry date. (Just brilliant). I know there is no way to remove them from the servers, but is there perhaps a way to crack them and issue revocation certificates? Is the cipher sufficiently aged/small to reasonably be able to crack them these days? I'm not really much of an encryption head, I only realised this when I started getting incomprehensible emails, so any help is welcome.

How can user credetials be leveraged when doing a penetration test for a Windows network?

Assume the following scenario:

NTLMv2 only

Only Vista machines or higher

Remote desktop disabled throughout network

No open shares

psexec needs administrative level access. Without any shares or way to remotly login, are any credentials captured useless in such a network?

If not, how could they be leveraged to gain further access?

How can I determine the domain controller when it's not in DNS?

On a penetration test going in blind for an organization, meaning no knowledge of network topology of design, no idea what the domain(s) might be, and domain controller is not apparent in DNS...how can it be determined what the Domain Controller is?

Assuming a dedicated DNS server instead of the DC handling DNS

Is there any way to determine what the domain controller is in this scenario?

promiscuous vs monitor mode in 802.11

I've been reading up on promiscuous mode and monitor mode as they relate to 802.11 networks. I understand the difference, which is explained here:

What is the difference between Promiscuous and Monitor Mode in Wireless Networks?

The definition is pretty simple. One you are associated with an AP, the other you are not.

My question is, what is the benefit of using promiscuous mode over monitor mode? When would you use one instead of the other?

If I want to monitor traffic between an AP and a device, both modes give me the capability. I feel like I am missing something that promiscuous mode allows you to do that you can't with monitor. I know monitor mode does not allow you to check CRCs, but still don't see a real advantage to using promiscuous mode beyond that.

Wife was conned into allowing her computer to be hacked, what do I do?

My wife had a popup on her old Windows Vista laptop (which I've been threatening to switch to Ubuntu Linux). It appeared to come from our ISP, and informed her that she was hacked, and to call a number. An Indian guy answered, told her to go to a site (lmi1.com), gave her a code, and told her to input it to download a program and run it, which she did. He told her she was hacked and it would cost lots of money to fix.

That was when she finally decided to call me at work, and after she finally told me about downloading the program, I immediately told her to disconnect it from the internet and turn it off. I told her to call our ISP to confirm that it was a scam/hack. They confirmed that it was not associated with them. We have an always on connection, which might explain why they targeted us.

She told me she was already logged in to her gmail account, but didn't log into any accounts after her interaction with this hacker.

I've been to the bank to shut down internet access for our bank accounts until we can deal with this further, and confirmed that the accounts were not accessed online since well before the attack.

We're going to back up her files (via a Linux live-desktop), and she's getting a bright shiny new operating system by the end of the weekend, and she won't be using the laptop until then.

My question is: What should we do now?

We don't need new bank account numbers, I think that would be an impotent action regardless, right?

It's conceivable they accessed her email from her computer (since she was logged in).

It's possible they downloaded files. I don't know if she had anything with social security numbers on it, but she might.

It's possible they began encrypting her files for the purpose of blackmailing her with their possible destruction, and she may have lost some of them.

I've told her to change her passwords on her email accounts. She mostly uses Google Chrome, not sure if that makes a difference.

Ancillary question: why doesn't the FBI shut down sites like lmi1.com?

Update: they called her back, and hung up after being challenged to give their address. I'm not sure what their angle is. If it's just an outright scam, that's it, no harm done. But they could try to mess with us. I don't think anyone would go to this much trouble to set up a zombie for a bot-net, would they? I wish I knew.

Can an executable be scanned for calls to the vulnerable glibc ghost functions?

The ghost vulnerability has the potential to be vulnerable to many many pieces of software that call the gethostbyname() and gethostbyname2() functions. Is there an easy way to scan an executable to determine if it makes use of either of these two vulnerable functions? While this wouldn't tell you if a program was vulnerable, it can tell you if it's NOT vulnerable.

To use either of these functions, I believe the executable (or 3rd party library) must link to it. It seems to me you should be able to scan the executable for a link to the shared library.

Machine actions in distributed systems

I am looking at the security implications of distributed systems, and am trying to simplify the way that I can model individual machines within a distributed system interacting.

The importance of the way they interact is with regard to the data within each machine, and what they do with it. In a regular system, the main actions a machine will perform will be to either create data, move data, or destroy data. (I hope I haven't foolishly left anything obvious out). In security, it is pretty clear that each of these will have associated security implications.

What I was wondering about was a couple more actions which machines may perform, which I am unsure whether to differentiate from the functions I have already named, for reasons that I will explain.

Modifying data is one example of something which I am not sure whether to include or not. Modifying data can be considered to be creating data, and/or destroying data. The destroying part is optional but I cannot think of a reason to include it as a separate consideration for the model I intend to produce. As someone who keeps everything to the maximum simplification, I would only include it if there is a specific security implication which demonstrates that it is a different action to the creation of data, and I was wondering if anybody could think of a reason it could demonstrate that.

The other one I was unsure about was whether or not to differentiate between alternative instances of moving data. Lets name these actions sending data, and requesting the sending of data. Between two machines A and B, with B receiving data from A, upon finding they have been encrypted with the correct credentials, B accepts the data and considers it to be from A, and stores this data. If B also receives data from A, and this data is a command which requests data to be forwarded from B to either A or an outside party, should this be considered the same as B receiving data (but not as a command), or are there significant enough differences that I should consider them different to each other?

It seems that the second instance is more likely to be justifiable to differentiate, but at the same time any data which carries the right credentials can be a threat (if sent from a malicious attacker who has broken into the system).

What are people's thoughts on these questions please?

can you use your GnuPG if you have lost your password? can you reset it after that?

can you use your GnuPG if you have lost your password, is there any way to get the password back if you have lost it?

DNSSEC: Does the algorithm of the ZSK need to match the algorithm of the KSK?

I am in the process of setting up DNSSEC for my domains. Initially I was going to go with algorithm 13 (ECDSA-P256-SHA256), but it seems that dyn.com doesn't allow me to add a DS record with an algorithm value of 13. (Would love some insight as to why they prevent this)

I figured, hey, no matter, there are two keys, right? I could have the KSK be algorithm 8 (RSASHA256) and keep the ZSK as algorithm 13. The ZSK is the one making most of the signatures anyway, so that is where the big win would be.

But it seems like dnssec-signzone was giving me a lot of grief. I eventually got it to seem like it worked, but dnssec-verify seems to consistently give me the following error:


$ dnssec-verify -o example.com example.com.db.signed 
Loading zone 'example.com' from file 'example.com.db.signed'
Verifying the zone using the following algorithms: RSASHA256.
Missing ZSK for algorithm RSASHA256
Missing self-signed KSK for algorithm ECDSAP256SHA256
No correct RSASHA256 signature for example.com SOA
No correct RSASHA256 signature for example.com NSEC
The zone is not fully signed for the following algorithms: RSASHA256 ECDSAP256SHA256.
dnssec-verify: fatal: DNSSEC completeness test failed.

So, my question is:

Is it legal with DNSSEC to have differing algorithms for the ZSK and KSK? If so, how can I sign verify the zone using the standard bind DNSSEC tools with such a configuration?

Apple CEO Tim Cook says 85% of new iPhone buyers are switchers, and mostly from Android

In a recent interview, Apple CEO Tim Cook discussed Apple's smartphone successes towards the end of last year, noting that most iPhone 6 buyers switched from Android.

(This is a preview - click here to read the entire entry.)

How do the Stack Exchange sites protect themselves from XSS?

It seems to me that because Users can post questions and comments in them with HTML markup (possibly <script> tags), Stack Exchange sites would be very exposed to XSS attacks. How do they protect from this?

Snort rule for outgoing attacks

I have pcap file that from a user PC. I need to analyse wehther it has initialized a DOS attack to any server.


alert tcp any any -> any 8080 (msg:"DOS flood denial of service attempt"; flow:to_server; detection_filter:track by_dst, count 1000, seconds 60; sid:25101; rev:1;)

This will give any incoming attacks. But I need to find outgoing attaks. Is there a way to do this?

Thanks in advance.

SQLmap over uni wifi

I don't know if this is the right place to ask this question but I'll give it a shot! I was playing around with Kali and SQLmap. I was just scanning some sites nothing serious. When I was doing this I was logged in on my University's wifi network. Now the problem I have just got an email for a meeting with someone. Now is my question if they're able to see what I've done wit SQLmap?

Is Java vulnerable to glibc GHOST Vulnerability in Linux?

I see on our RedHat Linux platform that "java" process has dependency over glibc library:


[root@hpproliant1 ~]# ldd /usr/bin/java
linux-gate.so.1 =>  (0xffffe000)
libpthread.so.0 => /lib/libpthread.so.0 (0xf7f77000)
libjli.so => /usr/java/32bit/jre1.6.0_26/bin/../lib/i386/jli/libjli.so (0xf7f6e000)
libdl.so.2 => /lib/libdl.so.2 (0xf7f69000)
libc.so.6 => /lib/libc.so.6 (0xf7e11000)
/lib/ld-linux.so.2 (0xf7f97000)

Does Java APIs call indirectly problematic glibc functions? If so is the jvm using the vulnerable function in a way that's vulnerable?

Undelete-secure AES software and software for carrying out "full undeletion" free-partition-space zeroing/reformatting on Windows?

It is fairly well known that on Windows, when you delete a file (or folder which may contain any number of files and subfolders possibly containing other files and subfolders and so on), Windows just deletes the filesystem pointer to the node corresponding to the file or folder in the corresponding filesystem tree structure.

So, I would like to know, if someone uses 256-bit AES as available as part of the implementation 7-zip, TrueCrypt, or BitLocker, or any other conforming software, and uses, say, a 20-character passord which uses uppercase, lowercase, as well as numeric digits, then the encrypted folder should would be encrypted with enough strenght that nobody could open it unless they had the password.

But my concern is that in creating the encrypted folder, the old data would remain unencrypted on disk, and could therefore be recovered with a program used to undelete files (and I'm sure there are several of these). So, which of the encrypting solutions I've mentioned actually zeroes-out the old data?

Even if so, I don't even know if this is a real solution. If the user has only moved the file across the same hard-drive throug cut-and-paste operations, then theoretically Windows would not have copied the information contained in the folder, just updated the pointer to it. But if the user has copied the information from one drive/partition to another, than the information contained in the folder would also end up being copied, and the information could still be recovered via a Windows undelete program.

Furthermore, I don't know whether there are any circumstances where the user doesn't do anything but Windows copies the data associated with the folder, leaving an old copy of the data behind (perhaps defrag, I don't know of any other situations).

So, my question is, how secure are 7-Zip, TrueCrypt, BitLocker, or any other preferable viable alternative, in fully deleting the original folder after it has been encrypted. If none do, then are there any programs available which will zero-out any unused portions of a drive/partition without reformatting it?

Thanks.

How to allow activesync, but block outlook iOS app?

An outlook application for iOS has just been released, and it seems like it is welcomed and rejoiced by many newssites:

http://ift.tt/1typIxr

http://ift.tt/1CPoa4b

http://ift.tt/1KbkZUJ

There is also a blog article about this application, and the security implications it has. Apparently, everything is siphoned into the cloud, and to achieve this feat, microsoft also has to upload the user credentials to the cloud service.

http://ift.tt/1A3Zzch

For many companies (hopefully), the way this application operates is not acceptable for their security policy. Aside from Ross's recommendation (for those who have reverse proxy to filter connections to activesync), and a corporate security policy, are there any technical means that could stop users from synchronizing their corporate exchange to the cloud?

How long do you really have to notify an end user of a data breach when multiple parties are involved?

Under HIPAA regulations we have 60 days to notify users of a security breach where PHI has been found to have been disclosed. State laws are a little more strict with California for example being 5 days (SB541 1280.15(b)).

In the extreme example that a subcontractor of a BAA finds that data has been compromised how long does the covered entity have to get that information out? With the 60 days from the federal law it's easy to build in that time in multiple layers of BAA's (say every one has 10 days to get it up to the next level) but 5 doesn't leave hardly any time at all if it's 5 days period from time of discovery no matter who discovered it.

The Moto 360 is about to get even more stylish

The Moto 360 already looks good, but it is about to look even better, with three new metal bands to be made available to make your Android Wear smartwatch even better.

(This is a preview - click here to read the entire entry.)

Is it dangerous to append search query to the base URL?

I'm testing drupal website and I've noticed that search query gets appended to the base URL in the response, like so:


query: "hey ho: there"
http://ift.tt/1zeGjas ho%3A there

query: "dis iz stackexchange!"
http://ift.tt/1yeT54L iz stackexchange!

query: "@ # $ % ^ & * ( ) < > [ ]"
http://ift.tt/1zeGjay %23 %24 %25 ^ %26 * ( ) < > [ ]

Is this behavior dangerous?

Any guess why any of the '* ( ) < > [ ] !' aren't escaped?

How to distinguish between a GPG private key from a public key?

How to tell if a file of a GPG key is a private key or a public key? By looking at the filename and content. Can you post the two examples of a dummy key pair?

Xcode's git still vulnerable (CVE-2014-9390)? What's the best practice here?

In December everyone and his grandmother were talking about CVE-2014-9390 and we were all busy installing the git maintenance releases.

Looking at my Xcode installment today - 41 days later - I still see a version 1.9.3 (Apple Git-50) from October lurking in /Applications/http://ift.tt/1bfjE1z.

Apple did update git in Xcode 6.2 beta 3. But apparently they didn't bother updating their current "golden master build".

So, if you are using Xcode's built-in git services, you are still working with a vulnerable version. What is the recommended approach in this situation? Delete the file?

Never spell a word the same way twice?

A long time ago I was reading about Renaissance-era ciphers and I remembered this quote:

David Kahn, author of The Codebreakers, quotes Giovanni Battista Porta who published, in 1563, a famous cryptographic book, De Furtivis Literarum Notis:

"He urged the use of synonyms in plaintexts, noting that 'It will also make for difficulty in the interpretation if we avoid the repetition of the same word.' Like the Argentis, he suggested deliberate misspellings of plaintext words: 'For it is better for a scribe to be thought ignorant than to pay the penalty for the detection of plans,' he wrote."

This idea of deliberately misspelling words is intriguing to me. I'm wondering, is this a technique that could potentially be effective against modern mass-surveillance systems?

For example, in an NSA-style mass-surveillance system that flags certain designated keywords, could deliberate misspelling of words (in an email or SMS, for example) potentially be used to avoid detection?


the bobm is hdiden isnide teh parlaimnet biuldnig

The idea is that it would work sort of like a CAPTCHA, making the message obfuscated for computers but still human readable. Is this realistic?

how to decrypt password which i find from a website?

I tried http://ift.tt/1yeEbew all of the hash checker but it shows page not found 404 error. So I am not able to decrypt this. Can anyone tell which type of hash it is $1$sd5.FJ4.$2ghA9ZdVNPcR2xKLviGBc1, and how I can decrypt it.

Extract pre-master keys from an OpenSSL application

Consider an application using OpenSSL which has a bug. A packet capture of the full SSL session is available, as well as a core dump and debugging symbols for the application and libraries. A RSA private key is also available, but since a DHE cipher suite is in use, this cannot be used to decrypt the packet capture using Wireshark.

Thomas suggests in this post that it is possible to extract keys from RAM. How could this be done for OpenSSL? Assume that the address of the SSL data structure is known and TLS 1.0 is in use.

jeudi 29 janvier 2015

How can I be sure that I'm downloading over SSL?

Maybe I'm asking absolutely dumb question, but I couldn't find the answer yet. I know when I'm sending or getting a data in a browser over https, both server and client (browser) checks each other certificates. If everything is ok the data transfer starts.

Now I wonder how to handle all this stuff in my code? I'm using some framework which allows me to download data. When I'm specifying an address as https://... I downloading stuff. But I didn't specify any certificates (I don't have any!). So how does it works in my case? Is it really https?

Here's an example that confused me: I have some file in dropbox. I can download it with my code if I specify https address. But also I can download the same file if I specify just http!

Could a fake tip that my server is compromised be a social engineering attack?

A little while ago I got the following email from an unknown party (using an @alum.cs.[redacted].edu email address):

I'm seeing attack traffic from your Linode. Just a friendly heads up that its likely p0wned. A quick google suggests no one else likes the traffic coming from your Linode either.

<http://ift.tt/1JSbNGJ's ip]>

However I couldn't find any evidence to support this assertion. I checked the resources utilization graphs provided by Linode, as well as my firewall logs, system's process list, active connections, recently modified files, user accounts, and so on, and found absolutely no anomalies. The results from the Google search didn't seem to back up the claim that nobody else likes the traffic either. I checked them out, and although I'm not a network professional (and thus don't know how to properly interpret everything I found), nothing I saw in the first few results raised any red flags. So either the server is fine, or I'm dealing with an adversary who knows how to cover their tracks so well that I can't imagine why they would have any interest in it. (There is no sensitive data on my Linode.)

This leads me to wonder whether the message could have been a form of phishing. In this particular case, I highly doubt it, but could something like this be a legitimate social engineering tactic? Is there something I would be likely to reveal by replying to this message which could be used against me in some way I can't think of?

How can I find company address with Company Name, zip codes and State of Existence?

I need to find the address of the companies located in a particular State with Company name and also zip codes.

Example:

Company Name: Integrated Care Management

Within the following zip codes in GA -


30062, 30319, 30338, 30005, 30022, 30075, 30076, 30092, 30004

Steps:-

Currently I googling the company name and search for the address in Google maps.

Sometimes will find their company website and take the address from it. For the above example I have mentioned, I found the following address through google maps

Addresss:- 3440 Preston Ridge Road Alpharetta, GA 30005

How can I get this done easily for more companies. Is there any website or tool to make it quite easy and less time consuming?

Intercept XMPP traffic in android

I have been learning security testing on android apps. And to intercept traffic I was using burpsuite. I know it works perfectly for http/https traffic. But most of the messenger apps are using xmpp protocol for their communication.

I made a few research on how the xmpp works, the relation with jabber and all. What I lack is a tool to intercept the xmpp traffic. Burpsuite is unable to intercept the xmpp traffic. I heard about xmpppeak and IMSpector but I didn't try them. I would like to know which all are the tools that help me to intercept xmpp traffic.

I understand tool recommendation is not entertained in stack exchange still I believe its a common requirement as attacks on android apps are rising high these days.

Correct approach to secure the back end service - oAuth

I'm developing a oAuth service (I'm thinking so. It might not be exactly the same.) to open one of our back end API to a Merchants.

basically users can purchase goods from Merchant's E-Commerce website and can use our payment gateway to do the payment.

we have registration system for merchants and users and we are issuing a ID(publically available alpha numeric ) to them.

My plan is for oAuth service.


   1) First merchant sends above mentioned id to our oAuth server.
   2) Then oAuth server sending token, refresh token and expiry time as response.
   3) Then merchant sends that token with other required information such as amount again to oAuth server to open our payment gateway web interface.
   4) user use that interface to provide his ID and pin to confirm the transactions.
   5) Then from over oAuth server we call our back end RESTFull service to do the actual transaction (Merchant account receive money and customer account will debited)
   6) After completion of transaction we redirect user again to merchant's website.

*All the communications are done via https channel.

I'm in doubt for


    1) Whether  my approach is correct to secure the above given flow.
    2) Do I really need a tokens here or only ID is enough? If I only used ID what I'm going to missing here.
    3) If so only ID is enough to obtain a token?
    3) Is there any possibility that some one can cheat the process.

Expecting you advices on this.

How is this web resource hidden from the user?

Motivation: I've been interested in how various agencies hide data, either through incompetence or willful intent, that is required to be "open". Specifically I've seen oil companies use images to display their transparency reports and financial companies display data via massive time-delayed queries to prevent scraping. Recently, I encountered a new method, this time implemented as a pseudo-DRM:

Question: How does myfont.com hide the font from the browser? Can it be defeated?

Research: Consider the page for the font Modern Brush. It showcases a webfont for sale. Under Chrome's developer tools there are several fonts listed:

enter image description here

but none of the fonts look like the font used on screen. The fonts are clearly loaded however, since there is an editable div:


<div contenteditable="true" spellcheck="false" 
  class="text headline" 
  data-font="Modern Brush" 
  style="font-family: 'Modern Brush';">
            The Wonder of Webfonts
</div>

and a corresponding CSS style:

enter image description here

Close votes: I think that understanding this particular technique falls under the purview of SE Information Security. Additionally, please note that this question asks for information on circumventing a DRM (even if the intent is pedagogic). These reasons may constitute a reason for closing. If so, please advise in the comments.

DES-CBC: Two ciphertext blocks c2 and c5 are equal. Why would this leak information?

Here, suppose that we were able to observe the ciphertext that we know had been encrypted in CBC mode, then how knowing of c2 and c5 ciphertext blocks would leak information ?

My professor asked us in the class and told us to think about it and gave us hint what would happen if we knew one of the plaintext blocks m2?

HTTP Host Header redirect traffic

Recently, I've seen periodic floods of traffic to my web servers with various Host headers that do not belong to us. The traffic appears to come primarily from China and a decent number seem to think we're a BitTorrent tracker. They come from a wide variety of IPs and User Agents.

Example BitTorrent tracker request (anonymized):


GET /announce?info_hash=%B8%86%E1hJ%A7%1Dm%AAvL%0F%CF%F3%F7%03%95%A8%AB%AF&peer_id=%2D5F21100%2D%04%0DA%DE%3D%D9f%A4%0Aw%A7%2A&ip=112.84.xxx.xxx&port=13777&uploaded=1150728262&downloaded=1150728262&left=2292077&numwant=200&key=937&compact=1 HTTP/1.0
Host: open.tracker.thepiratebay.org
User-Agent: Bittorrent
Accept: */*
Connection: closed
X-Forwarded-Proto: http
X-Forwarded-For: 112.84.xxx.xxx

Example TypeKit image ping request:


GET /p.gif?s=1&k=yoe7ink&ht=sh&h=get.adobe.com&f=7180.7181.7182.7184&a=204670&_=1422582942577 HTTP/1.1
Host: p.typekit.net
User-Agent: Mozilla/5.0 (Windows NT 5.1; rv:35.0) Gecko/20100101 Firefox/35.0
Accept: image/png,image/*;q=0.8,*/*;q=0.5
Accept-Language: zh-cn,en-us;q=0.7,en;q=0.3
Accept-Encoding: gzip, deflate
Referer: http://ift.tt/1A59iiy
X-Forwarded-Proto: http
X-Forwarded-For: 27.189.xxx.xxx

Note that the web servers in question are behind a load balancer (Linode NodeBalancer), so the X-Forwarded-For and X-Forwarded-Proto headers are expected; they correspond to the original requests to the load balancer.

As far as I can tell, the web server is not acting as an open proxy. The response to these requests is simply a 302 redirect:


HTTP/1.1 302 Found
Date: Fri, 30 Jan 2015 01:56:00 GMT
...
Location: http://ift.tt/1zklYz9
Status: 302
Vary: Accept-Encoding
Content-Length: 108
Connection: close
Content-Type: text/html; charset=utf-8

<html><body>You are being <a href="http://ift.tt/1zklYz9">redirected</a>.</body></html>

The switch to /guide is provided by the Rails application that normally runs on these servers. It normally redirects some types of 404 traffic to http://ift.tt/1A59iyO.

I have two questions about this:

Why are we receiving this traffic? What possibly can someone gain by using our servers to generate large numbers of HTTP redirects? It doesn't seem like they are pulling off an XSS attack on the unvalidated Host header.

What do I do about it? Can or should I reconfigure Apache to reject requests where the Host header doesn't match a domain we own? Is there a way to figure out who is sending this traffic our way? Should I get a new IP for the load balancer?

How can I demonstrate data encryption? [on hold]

i am asking that in WPA-2 they used aes-ccm algorithm in that data encryption with ctr mode before that for data integrity cbc-mac algorithm used for mic tag then with that we encrypt data and send to receiver.so i am saying that if we do data encryption with any stream cipher algorithm and output of that algorithm that is cipher output give input to h-mac algorithm for integrity purpose.so how to show demo of this as a practically?

Encrypt database records to be accessed by multiple users

The naive approach would be to use a system-wide key for symmetrical encryption using AES or similar, however I'm not sure that this is any more secure than no encryption at all.

Thanks

RESTful web application security and authentication scheme

I am building a web application where the front-end is a single-page-app and the back-end serves it through a RESTful API. I want to make sure I implement user authentication with the best security practices.

I am planning a system that will perform the following steps to ensure authentication security:

Signing up (or changing password):

User sends username and password to server in plaintext via HTTPS

Unique salt is generated with Python's urandom function (32 chars)

Salt prepended to password

Salt + password is hashed with bcrypt

Salt and hash stored in database table (SQL database, slower than key-value but I'm not too concerned about superspeed for logging in)

Random session id generated with urandom (32 chars)

Session id stored in key-value db (Redis? Key: user id, value: session id) and sent to client along with user object (obviously without salt and hash)

Logging in:

When logging in, user sends username and password to server in plaintext via HTTPS

Server retrieves salt and hash from users entry in SQL db

Salt prepended to password and put through bcrypt

If both hashes match, session id generated with urandom and entered into key-value db

Session id sent to client with user object

Any other request to the server:

Request and data sent via HTTPS including user id and session id

Key-value db searched with user id, if session ids matching, return requested data along with user object

If not matching, return error 401

Session handling:

Allow more than one session for the same user

Set expiration of session to 24 hours, when accessed, put back to 24 hours

Allow persistent session which expires in 1 month, when accessed also put back to full expiration time

On logout, remove session from Redis

Will this be a secure, scaleable and fast (when necessary) system? If not, where are the security flaws? What could I do to improve this process?

Any way to revoke old key pair?

Why is it dangerous when an attacker can control the `n` parameter to `memcpy()`?

I was reading a paper and saw this piece of code has an information leakage vulnerability. It was saying the following code will Leak memory layout information to the attackers

Could somebody please explain me how this leaks information?


struct userInfo{
    char username[16];
    void* (*printName)(char*);
} user;
...
user.printName = publicFunction.
...
n = attacker_controllable_value; //20
memcpy(buf, user.username, n);   //get function ptr
SendToServer(buf);

I can see memcpy will give exception but why should it return memory address to attacker(or whatever it is returning)?

Thanks in advance

Using NoScript to block plugins (such as Flash) without blocking JavaScript

I am looking for a way to configure NoScript in Firefox to block all plugins (Flash, Java, Silverlight, Shockwave, etc.) without blocking JavaScript, but the default options only seem to allow the possibility of blocking JavaScript plus plugins.

How can I leave JavaScript enabled and just block plugins?

Phablets like Galaxy Note 4 and iPhone 6 Plus predicted to flood phone market

A new report suggests that phablets like the Galaxy Note 4 and iPhone 6 Plus will continue growing in popularity, potentially flooding the smartphone market by 2019.

(This is a preview - click here to read the entire entry.)

Unpublished server

Is it possible to setup my web server such that only certain sources can access and the public from internet has no access? i am thinking that we could just not publish our web server URL/IP to our upstream public DNS. And we give the static IP of our web server to the authorized sources to access. Of then, we will have to turn on firewall rules to allow only those sources in to our web server network. Is this thought feasible? thanks

Hacking using public IP

I have only ever hacked websites/internal networks and am curious about how people hack over the internet.

From what I gathered, this can be done by: 1. Installation of malware, virus, etc on user computer so that user is constantly connected to the attacker. This allows for the attacker to have knowledge of the user's IP address at all times which is useful if the victim is using a dynamic IP. 2. Getting to an internal network through the internet and then hacking private IPs. I guess this is an attack vector but I may not have any idea what the fuck I am talking about.

I have read that it is possible to nmap a public IP which would give ONLY the private IP of the router because it is doing NAT. If so, how does this work? http://ift.tt/15YTksG

How is the nmap scanning public IPs to return with PC OS versions? If I run metasploit using public IPs, what device am I actually attacking?

Other than these are there any attack vectors?

How to check if my usb drives are vulnerable by BAD USB

Mark pointed out that only one chip type is vulnerable to BAD USB, id like to check if mine are, am using only Kingston flash drives here so can you tell me if they are, or if there exists a list somewhere i could check this? thank you.

Risks of booting from Live OS image on USB

Beside the risk that a live system residing on a usb stick infected with bad usb could be infected in the first place, can the system booting from the bad USB device get taken over the same way?

Wordpress site security issue

I can't seem to figure out where the hole is in my wordpress that causes a hacker to install some php files in some wordpress directories. The security plugin Wordfence, catches those files, but I can't seem to understand how this happens. Any help appreciated. Image attached that shows what Wordfence catches enter image description here

SSO software – where is symmetric key stored?

In SSO software (Oracle E-SSO …), I heard about (primary) key encrypting user’s credentials, but I can’t read anything about how this key is managed ?

When using smartcard, I can understand that this key is encrypted/decrypted using another key pair on the card, but when smartcard is not part of the scheme, how does it work ?

GHOST bug: is there a simple way to test if my system is secure?

GHOST (CVE-2015-0235) just popped up. How can I quickly check if a system of mine is secure? Ideally with a one line shell command.

According to the ZDNet article "you should then reboot the system". Ideally the test would also indicate this...

Samsung Galaxy A5 – mid-range specs with flagship looks

The Samsung Galaxy A5 is the company's latest mid-range phone. In our Galaxy A5 review we take a look at hardware, software, tech specs, release date, price and features.

(This is a preview - click here to read the entire entry.)

Sign PKCS#7 and verify PKCS#7 signature with OpenSSL

If someone have to transfer X.509 certificates in a single bundle, usually, it is recommended to pack them into PKCS#7. And content of PKCS#7 can be signed.

OpenSSL allows to pack certificates into PKCS#7 in the following way:

openssl crl2pkcs7 -nocrl -certfile domain.crt -certfile ca-chain.crt -out domain.p7b

As I understand from the man page of 'openssl crl2pkcs7', this PKCS#7 is signed:

The output file is a PKCS#7 signed data structure containing no signers and just certificates and an optional CRL.

A few questions here:

What does 'containing no signers' mean?

If the content (certificates) of PKCS#7 is not really signed, how can it be done using OpenSSL?

How signature of PKCS#7 can be verified using OpenSSL considering that it was signed?

If I understand overall concept wrongly, please, clarify that.

Using AES in CTR for TCP/IP based network connections - need to encrypt the IVs?

For AES based encryption on TCP/IP connections, I am guessing I have to do the following:

Have the 2 parties share a common key, assuming I am doing AES-128 then a sequence of 16 bytes. Ideally the bits are securely random.

Since we are running AES in CTR mode and the secret key is fixed, we must choose a securely random IV for each stream instance. Since a TCP/IP connection is actually full-duplex I assume I need 2 IVs per connection, one for each direction. I also need to transmit each IV to the other end in order for the corresponding stream to be decrypted.

Edit note: the scheme described above is prone to replay attacks. Maybe a better scheme is to send the decipher IVs to the other party and force the other party to encrypt a constant, and if we can decipher to get the constant back then the other end is authenticated. Also the scheme does not provide message integrity.

My question is, for the IVs, should I be encrypting the IVs with my secret key before sending them over? I was told IVs don't have to be kept secret. Is there any security benefits if I do encrypt them before sending across?

ps. you may wonder why I am not using SSL/TLS. Our application does support SSL/TLS, but we also want to support alternate symmetric encryption mode where connection overhead can be minimized, as clients constantly disconnect and reconnect.

Is using a MAC for encryption requiring a need for PKCS7 padding with this class?

I am working with this PHP encryption class using CRYPT_RIJNDAEL_256 and MCRYPT_MODE_CBC with a fixed 32-byte (64 character) HMAC key, as my basis.

The class is a result of previous discussions and remarks made on this blog page. and seems like a solid implementation as such. However there are a few aspects discussed I am still not clear on:

The only thing it adds is predictable plaintext positions which will aide a cryptanalyst. I recommend removing the serialization and using PKCS7 padding.

comment 1304.

Now that the encryption method uses HMAC and that the serialization avoids the '\0' padding issue. Is it still a good idea to use a PKCS padding even when the HMAC is used (and the serialization kept)?

Or in other words, does the HMAC alone solve the "predictable plaintext position"?

How to visualize what's happening with SQL Injection test?

I am testing an eCommerce site for SQL injection vulnerability, and am uncertain what is going on.

When I put in ', it just says No match found for " ' ".

When I put in 'true, it brings up about 6000 items matching the word "true", such as "true mahogany shelf."

When I put in true, it brings up about 6000 items matching the word "true," as above.

When I put in ' or true, 35000 items come up, but it starts by listing the ones that match the word "true."

So I'm not sure what's going on. The fact that the matches went up by a factor of 7 on the last input implies to me that it's vulnerable, but the fact that it's still searching for the word "true" implies that it isn't.

I'm not sure how to continue penetration testing from this point. Any advice on what to read?