InfoSec Institute

> though where the pinephone really - really - shines is pentesting. Its worth having some near field communication pentesting apps on it, as many mental health hospitals use NFC bracelets for locking people up and to control what corridors they can get access to within the building so it could be an easy way to walk out of those sorts of establishments where lock and key are no longer used. https://en.wikipedia.org/wiki/Near-field_communication#Criticism https://resources.infosecinstitute.com/topic/near-field-communication-…

The NASA Terra Earth orbiter was successfully attacked in 2007/8 — http://resources.infosecinstitute.com/hacking-satellite-look-up-to-the… “The best known of alleged takeovers of satellite control occurred in 2007 and 2008. In particular, a serious attack was observed in 2008 when hackers obtained the control of the NASA Terra EOS earth observation system satellite for 2 minutes in June and for another 9 minutes in October. Fortunately the attackers didn’t damage the satellite during the time they gained control of it.”

>> My guess is the I2P gets more scrutiny from the US government, because it's much harder to break versus TOR How so? Is this what is alluded to by "onion vs garlic" routing design? http://resources.infosecinstitute.com/anonymizing-networks-tor-vs-i2p/ (I can't get the I2P explanation/comparison on their official site right now; not sure it's me or them, haha.) Again, I read a while back. I am pleased to know it is more secure. Personally, I liked they had easily accessible Android builds directly from them at the time. But the Tor devs do so much good development, tech writing on the blog, and research publication it is hard to love or hate either group as they save the Internet from itself.

Here's the problem with that - most of these recommendations are for convenience, and tend to run counter to security recommendations. Files and directories on a web server should never be owned by or writable by the web user. They typically don't need to be world readable either (if they are, and your web server is compromised, then you start to leak a lot of unrelated data out over the compromised service). Here's a pretty minimalistic list of recommendations worth looking at on properly securing a web server: http://resources.infosecinstitute.com/securing-linux-web-server/

There is a whole industry of people in India/Pakistan that do this. Their recommendations are pretty straight forward and usually based on basic vulnerability scanners and password best practices. It is very likely you can figure out your issue yourself, it is likely very obvious. I believe that this user is likely correct that there is a vulnerability and I would suspect it is a fairly straight forward one and you'll think it wasn't worth even $250. Here is a list of open source vulnerability scanners: https://resources.infosecinstitute.com/14-popular-web-application-vuln… And check your password practices, your headers to prevents XSS/iframing, and get your SSL certificate checked via an online tool. Also check the version numbers of your web server, jQuery, etc to ensure that you are not using one that has a security issue. The guy you are dealing with is not sophisticated, just looking for a quick buck doing something simple you are not doing.

I stand out a little bit, because although I'm a "Valley-type techie", I'm also a woman with purple hair. Being a woman in tech has its pros and cons. The Silicon Valley I'M based out of is what some in the tech media refer to as "Silicon Valley North"- Toronto. (I also live near downtown, but that's irrelevant.) I was a computer whiz ever since I was a very young girl. By the time I was 11, it was 1995 and I just got into web development, as a self-taught hobby. (There, I just dated myself.) I didn't even consider a career in tech until I was already in my mid-20s. Why? I theorize that being female (girls aren't encouraged to get into computing as much as boys are) was a minor reason, but being told by teachers in the public school system for years that you have to be EXCELLENT at math to get into computing professionally is the main one. I'm not bad at math, but I thought I was when I was a kid. I blame former Ontario premier Mike Harris. In the 1990s, he really fucked up the school system. One of the policy/curriculum changes he and John Snobelen orchestrated was "show your work" in math. As soon as arithmetic and algebra get more complex, I use different techniques to solve problems than the mainstream ones in textbooks. For example, I don't do long division. I look at a division problem, figure out what the largest "X times Y" is that fits into the number I'm dividing, and I work back and forth from there. I can even get a decimal answer correct down to the first few…

this may be helpful. file utilities often make turds in the file. use a hexeditor to handcraft a file, and you can trim it down to a header and footer https://resources.infosecinstitute.com/topics/hacking/pdf-file-format-…

Not rooting your phone, but hacking the baseband. And since we're talking about disassembling devices and performing low voltage attacks to reveal secrets, I would draw the analog to baseband hacking. https://resources.infosecinstitute.com/topic/how-to-hack-mobile-commun… ...found a vulnerability (CVE-2022-20210) that can be abused to disrupt the device’s radio communication via a malformed packet causing a DoS condition. This vulnerability allows attackers can neutralize communications in a specific location.

It is used a lot, also to identify people on TOR. But you usually need something else if you want to use that in court. See: https://resources.infosecinstitute.com/topic/timing-analysis-attacks/ Or the academic research on the domain https://scholar.google.com/scholar?hl=en&as_sdt=0%2C14&as_vis=…

> During the last decade, several types of software and malware used the DNS protocol for data exchange. https://resources.infosecinstitute.com/topic/bypassing-security-produc…

I don't know where you are at, but I know for a fact that a scan of a signed document is binding in the EU. As far as I understand it doesn't even have to be a scanned document, you can sing a digital document by adding an image of your signature or just using your finger and a touchscreen. In the US from what I read[1] the situation is pretty much the same a scan of a signed document is binding as well as non cryptographic electronic signatures. [1] https://resources.infosecinstitute.com/topic/legality-electronic-signa…

Anthem had another breach in 2015 [1]. Offered free credit monitoring then as well. They were sued and settled in 2017 [2]. [1] https://resources.infosecinstitute.com/topic/the-breach-of-anthem-heal… [2] https://www.businessinsurance.com/article/00010101/NEWS06/912314090/An…

File Carving: https://resources.infosecinstitute.com/topic/file-carving/

On the contrary, certificate breaches are a constant source of issues. https://resources.infosecinstitute.com/topic/cybercrime-exploits-digit… There have been cases of breaches at various root CAs, including Adobe products; the Zeus Trojan that had a forged Microsoft certificate; a Dutch government cert breach that impacted Facebook, Twitter, Skype, Google and also intelligence agencies like CIA, Mossad, and MI6; A breach at ANSSI, the French Cyber Security Agency. Then of course there's the recent SolarWinds debacle that should kill this notion once and for all.

Yes. It’s called xhelper and it can survive factory resets. https://resources.infosecinstitute.com/topic/xhelper-malware-what-it-i… Unless the factory image and firmware are completely immutable they can be infected. There have been other non phone malware that can survive on certain chips on computer motherboards which would exist independently of both RAM and hard disks. Even GPUs can be infected if they have memory that does not clear when the capacitors discharge. https://arstechnica.com/information-technology/2020/11/intel-patches-h…

Clicking links can be a problem in corporate environments where automatic login has been enabled on Internet Explorer and outbound SMB not blocked. The phishing site immediately gets their domain ntlm hash, which can often be cracked to gain a password. This can also be a problem in PDF and Word docs without the need to employ a 0 day. https://resources.infosecinstitute.com/steal-windows-login-credentials… Also to note that password managers can help mitigate phishing, as they will not offer to complete passwords if the domain does not match.

Because anyone can embed JavaScripts into PDF file and launch stuff. https://resources.infosecinstitute.com/analyzing-malicious-pdf/

The laws in the UK are already far more restrictive than our American cousins when it comes to advertising. “traffic data” and “location data" are already covered by the e-Privacy Directive 2002/58/EC. Source: http://resources.infosecinstitute.com/differences-privacy-laws-in-eu-a…

> How is this illegal? Same as anything else: because there are laws forbidding it. http://resources.infosecinstitute.com/legality-ddos-criminal-deed-vs-a…

It was a javascript vulnerability, CVE-2013-1690. After free of a DocumentViewerImpl object, triggered via an specially crafted web page using onreadystatechange events and the window.stop() API, you could execute arbitrary code. http://resources.infosecinstitute.com/fbi-tor-exploit/

I suggest that the measures are largely security theatre to begin with. Consider the attached accounts of determined identity thieves (1,2). Facebook needs to inconvenience children, but also needs to acknowledge its own theatre in serious situations. Consider that many of the mechanisms that government issued ID use to prevent forgery are impossible to verify unless you're in physical possession of the ID. It also needs to provide a mechanism by which it does not gain and store additional information during the process of someone trying to opt out of their privacy free zone. 1 - http://www.bloomberg.com/news/articles/2015-07-15/an-identity-thief-ex… 2 - http://resources.infosecinstitute.com/confessions-of-an-identity-thief…

I'm not sure of the specific reasons in this case. I think it was to do with possible internal host discovery. (I'm not sure how that would work in practice. Yes you can use traceroute, but I'm not sure how that would work behind nat, without forcing a client to open up a port first) Possibly its to do with worry about smurf attacks, but then most firewalls > 2004 should deal with that gracefully.(old company though...) Have a look here, its an easy read and has a nice list: http://resources.infosecinstitute.com/icmp-attacks/

There are ways to solve captchas somewhat reliably programatically. I suspect this plugin only works on certain computer generated captchas, not the street sign ones. http://resources.infosecinstitute.com/introduction-to-automated-captch…

here's the one referenced in the Fox inerview from Snoopwall. They seem legit. http://www.snoopwall.com/flashlight-apps-spying-revealed/ also http://resources.infosecinstitute.com/android-app-permissions-security…

In August 2013, the FBI injected a Javascript exploit with a MITM attack to uncloak the real IP addresses of people accessing Silk Road over Tor: http://arstechnica.com/security/2013/08/attackers-wield-firefox-exploi… [edit] Nerdier link with exploit demo: http://resources.infosecinstitute.com/fbi-tor-exploit/

The five eyes IC apparatus has invested in Tor relays and mitm attacks of Tor exit traffic so much so that I personally think using Tor endangers you [1]. They were doing this ~10 years ago (public info - [2]). As for the surveillance state,I keep pondering other aspects of society. Like how public restrooms are intentionally designed to lack privacy,how in the military and prison you're expected to be comfortable with being completely naked around others and how it is completely acceptable for an arrested citizen to be forced to undress in front of other prisoners and possibly undergo a full on body cavity search all without the chance to defend his accusation in court. I could go on,but you get the point. I am not so sure the people want privacy. Or maybe they think so lowly of their freedoms,short term safety is always more preferable. From the intelligence community's perspective, it's all about information control. They do this in other countries. They topple regimes and adjust public opinion in the inteterests of western security and economical goals. If I was in their shoes, I can see myself using fear of other countries doing the same thing against us and use that as an excuse to "beat them to the punch" and take control of information flow in the west. They simply don't have the clear consent of the people to use the means they use by which they justify the end goal: national security. Regardless of how oblivious and clueless the people may be, the very…

This is reminiscent of the 2013 takedown of Freedom Hosting.[0,1] Exploiting a JavaScript vulnerability in Firefox, compromised sites dropped a Windows executable (“Magneto”) which phoned home (bypassing Tor) with the user's MAC address and hostname. Gareth Owen identified it as EgotisticalGiraffe,[1] which is an NSA tool.[2] [0] http://resources.infosecinstitute.com/fbi-tor-exploit/ [1] https://ghowen.me/fbi-tor-malware-analysis/ [2] http://www.theguardian.com/world/interactive/2013/oct/04/egotistical-g… Edit: Rereading, I see: >The NIT exploit bypassed Tor by creating a direct socket connection that eschews Tor's routing—in this particular case, by using a Flash component. This functionality, the experts noted, was identical to Metasploit's decloaking code. Anonymous used the Metasploit code in a previous attack on Freedom Hosting. Both vulnerabilities used against Freedom Hosting have long been patched. I wonder what vulnerability this takedown exploited. One of the Hacking Team ones, maybe?

I'm not using the right words, but it isn't that easy. On modern phones, even if you have an image of the phone's storage, the code you enter is merged (wrong word) with a large random number stored in an externally inaccessible chip in the phone (different for each phone, obviously). This large random number is then used as a seed to encrypt the drive. So it's not anything like just extracting the disk image then brute force attempting the 10000 valid codes from 0000-9999. edit: here is a better explanation Apple was a front runner in implementing some sort of encryption long before others even thought about it. Apple uses a 256-bit device-unique secret key (UID) stored in the phone’s hardware, where it’s hard to extract from. Apple says this UID is unique to the device and it doesn’t store these values. It also says that no software or hardware can read this key. This UID is mixed with the passcode to generate a new key (passcode key) to secure data on the device. Unlike Android, this UID key can’t be extracted from the device, so all the brute forcing attempts have to be done on the device itself. [1] So I would guess it's reasonably secure to non-governmental adversaries. If you're worried about governments, the US now supports torture (the only person punished for torture during the war on terror was a whistleblower), so the NSA is free to torture your code out of you. [1]…

> Verify the ROMs integrity in that first stage (...) need open firmware or some mechanism to hash the ROM that is installed, you need to have a means to read it in its entirety" Does such a mechanism exist? If you can do this[1] from BIOS, why is it safe to assume that the same can't be done for the dump-bios-image routine? AFAIK the BIOS handles this in real-mode [2] (overrides the OS), and "returns" the image by copying it somewhere in low memory. So, you're trusting the BIOS that it's copied the right data out for you. (goodguybios) > I say open firmware because you need to be able to guarantee the FBI couldn't embed a backdoor firmware. This reminds me of this NSA RAID controller rootkit for Dell Poweredge Servers [3]. Nuts. Every closed firmware on your servers is a potential hiding place to someone with (soldering-iron-to-the-motherboard) physical access. In our Dread Pirate use case, you don't even have to think that far as you can't ensure your own BIOS. Who are you going to buy TPM servers [4] from, when you're defending against the FBI? Intel? HP? The Rootkit wikipedia page is alarming, to say the least. [5] -- [1] A Real SMM Rootkit: Reversing and Hooking BIOS SMI Handlers http://phrack.org/issues/66/11.html#article [2] http://en.wikipedia.org/wiki/Real_mode [3] http://resources.infosecinstitute.com/nsa-bios-backdoor-god-mode-malwa… [4] http://en.wikipedia.org/wiki/Trusted_Platform_Module [5]…

Tor hidden services are not bulletproof. Just as a really simple example, you can do network traffic analysis to find network nodes with one-way traffic to hosts without a correlated public service and deduce if a hidden service is nearby. There are several exploits which have been used in the past to expose Tor hidden services, and several papers on theoretical ways to expose them. Many of these attacks can be used in reverse to expose the origin of a connection to a hidden service. In the [not so] extreme case, the govt can always issue a National Security Letter to WaPo and scoop up any data it wants directly from the hidden service servers, similar to its Silk Road and Freedom Hosting takedowns. The FBI TOR Exploit [ http://resources.infosecinstitute.com/fbi-tor-exploit/ ] Heartbleed used to reveal Tor hidden services [ https://blog.torproject.org/blog/openssl-bug-cve-2014-0160/ ] Hot or Not: Revealing hidden services by their clock skew [ http://www.cl.cam.ac.uk/~sjm217/papers/ccs06hotornot.pdf ] Tor Hidden Service Passive De-Cloaking [ http://blog.whitehatsec.com/tor-hidden-service-passive-de-cloaking/ ]