Simple Security Questions

This is the Simple Security Questions thread for simple questions. If you have a simple question and a suitable thread doesn't already exist, just post it here and someone will probably try to answer it for you. Remember to do some research before asking your question. No one wants to answer a question that a simple search can already resolve.

Lains, I need help configuring a firewall and nat using iptables. I am simulating a net using mininet, pic is a graphic of the net. In r2 I have executed the following command: iptables -I FORWARD -j DROP iptables -A FORWARD -p TCP --sport 80 -s 10.0.1.2 -j ACCEPT iptables -t nat -A PREROUTING -p tcp --dport 80 -i r1-eth0 -j DNAT --to 10.0.1.2 The idea is that h2 makes an http request to r2 and r2 sends the request to the server in h1 (10.0.1.2) What I do is execute nc -l 80 in h1 and then execute wget http://10.0.1.1 in h2. It gets stuck in --2019-07-01 16:58:21-- http://10.0.1.1/ Connecting to 10.0.1.1:80... What am I doing wrong?

>>7985 What does nmap say?

>>7986 I don't really know what you want me to do with that, but I did execute nmap in h2 to r2 and it said: Starting Nmap 7.60 ( https://nmap.org ) at 2019-07-02 16:40 -03 Nmap scan report for 192.168.100.1 Host is up (0.00067s latency). Not shown: 999 closed ports PORT STATE SERVICE 80/tcp filtered http Nmap done: 1 IP address (1 host up) scanned in 20.08 seconds nmap from h2 to h1: Starting Nmap 7.60 ( https://nmap.org ) at 2019-07-02 16:39 -03 Note: Host seems down. If it is really up, but blocking our ping probes, try -Pn Nmap done: 1 IP address (0 hosts up) scanned in 3.12 seconds

>>7989 >Note: Host seems down. If it is really up, but blocking our ping probes, try -Pn Try that when doing h2 to h1. See if it returns the port as open. Just looking at the config, there's a couple things that I think it could be, although I could be wrong. > iptables -I FORWARD -j DROP From the man page: >Insert one or more rules in the selected chain as the given rule number. So, if the rule number is 1, the rule or rules are inserted at the head of the chain. This is also the default if no rule number is specified. Since you're not specifying a rule number, this becomes the first rule in the list. > iptables -A FORWARD -p TCP --sport 80 -s 10.0.1.2 -j ACCEPT Again, according to the man page: > Append one or more rules to the end of the selected chain. Wouldn't this mean that the DROP rule is evaluated before the ACCEPT rule? Also, designating the source port as 80 won't work, since h2 is likely going to attempt to connect to h1 using an ephemeral port. You'd likely instead want to change that to be destination port. I honestly have no idea and could be completely off base here, as I've never really manually configured iptables rules.

>>7990 I fixed it, thanks. You made me question my self how well I know how firewall rules and read. I was wrong. >Also, designating the source port as 80 won't work, since h2 is likely going to attempt to connect to h1 using an ephemeral port. I think you got it backwards. The server is in h1, h1 is going to connect to an ephemeral port in h2

Anyway, I still don't understand why it wasn't working. h2 is sending data directly to r2, so the packets should have been compared with input rules, not forward

>>7991 Since it's stateful, wouldn't the source port be the ephemeral port from the client, and the destination port would the listener on the server? >>7996 Man page says the following: > It contains the built-in chains INPUT (for packets destined to local sockets), FORWARD (for packets being routed through the box), and OUTPUT (for locally-generated packets). Since the packets aren't destined for local sockets, it would be handled by FORWARD, not INPUT.

>>7997 >wouldn't the source port be the ephemeral port from the client, and the destination port would the listener on the server? That is correct, but that is for the packet that goes from the client to the server. The rule is for the router to let the web server's answer go through (the packets that go from the server to the client), these packets will have source port 80 right? >Since the packets aren't destined for local sockets, it would be handled by FORWARD, not INPUT. Why isn't it destined to local socket? I did wget http://*ip of router 2* wouldn't that send it to a local socket of r2? is it because there is no program listening in port 80 (i.e there is no local socket) that is handled by FORWARD?

>>7998 You'd be better off using --state ESTABLISHED, RELATED

Is port 80 in i2p tunnel configuration secure? Specifically asking because of what I've seen in this guide. And I have to configure php to something. https://github.com/eyedeekay/basic-tunnel-tutorial

By the time I finally figure out iptables, everyone will have moved on to nftables. Then by the time I figure that out, bpfilter will be the new hotness and I'll forever be left in the dust. ugh I should just say fuarrrk it, move to BSD and figure out pf.

And if not, how do secure it? This is my LUKS-on-LVM setup: Two hard drives are in LVM RAID configuration with both / and /home logical volumes encrypted with LUKS. Next I have an SSD with one unencrypted partition for boot and the rest is set as an LVM cache for the raid volume group. Now I don't know how to directly encrypt the cache *and* decrypt root at boot. Nor can I do LVM on LUKS on LVM because then I wouldn't be able to specify the raid or cache setup. Right now I'm banking that because its LUKS on LVM whatever is written to the LVM is encrypted already. But I don't know for sure.

Been searching around and can't find anything on this. I'm trying to crack a simple box which accepts an image attribute through a HTML POST form. The form looks like this: <form> <img src='some_url' readonly=true> The resulting URL looks like http://blah.com?image_attr=some_url This is an obvious vulnerability, right? What are some ways to take advantage? Port 443 shows Node.js installed, but I can't be 100% sure that's what the form is built on.

>>8061 Bit of an exploit noob but I'm not sure why you think that _must_ be a vulnerability.

>>8069 It basically looks like a potential http redirect. If the URL is taking the image_attr asepct directly from the img_src without sanitizing it, you could do some stuff.

How do I hide wifi sniffing device in building? What about energy source?

rasberry pi with a box or sign that says do not touch, i had friends on red team assessments and defcon panels way it works alot, plug it in the wall if that isnt possible you could try rig a batterypack to one and see if that works

sup lains, secnoob here, i have a problem with my admin page, the pic related shows the problem as clearly as i could make it, my router only allows wired pcs to log in to the page (pc1) whilist blocking pcs that are connected wirelessly (pc2), the problem kicks in with a wifi repeater i have, which is wired but lets wirelessly connected pcs in the page (pc3), what can i do?

hey, I'm looking for some introductory resources on email spoofing, from either side; does anyone have any recommendations? articles, tutorials, recommendations on things to familiarize myself with, I'll take whatever

>>8089 Tutorials? I didn't think it got much deeper than just setting a script to send a mail with a different address in "from". Does it? /* This might be wrong. But its generally the idea.*/ <?php mail($TO, $SUBJECT, $MESSAGE, $FROM_NAME, $FROM_EMAIL, $REPLY_TO); ?>

>>8089 As far as I know about it, the SMTP servers that get a message from the client will blindly trust them because no real authentication verification is hard coded in the protocol of communication itself, but some of the notable providers have mitigated it to heavy degree.

If cloudflare can regularly MITM TLS, why don't websites RSA encrypt passwords before sending them over HTTPS, instead of sending a plaintext password that could be harvested by someone in the middle?

>>8123 You're sending the JS to do the RSA over the compromised channel, in that threat model >CF subbing in their own "master" key for the JS to encrypt to, then re-encrypting it with the actual master before sending it upstream >CF just injecting JS to run alongside the RSA JS, sending all submitted (or even just typed) pws to them in some way due to the above, nobody would even consider going through the enormous PITA and dev-hour expense to roll their own crypto stack to transport passwords in such a matter (yes there'd be huge outcry if CF actually did either of the above, but that's not going to be enough to set anyone's mind at peace if they don't trust CF with literally everything else in the first place) If they're that worried about MITM threat, there are existing protocols to kind of work around that (look up "challenge-response" auth systems); but for most people's threat models that's kinda moot/insoluble if the code itself is being delivered over the same compromised* channel *RSA, Ed25519, etc. let you bootstrap confidentiality given authenticity(which implies integrity), but there's not really a good way to assume the authenticity in the first place if you're concerned about CF being a bad actor

If I block scripts (Especially from fuarrrking Google, its everywhere), will is also block the connections to that website. That is, will they still be able to see my IP, but not use javascript magic to extract all of my browser and computer details? Requestpolicy and/or uMatrix?

>>8017 iptables is a headache i use firewalld firewall-cmd to manage it for me, with some success

This is a stupid question, but I'm curious. Are there any computer cases that are designed for security? Like limiting access to ports and stuff so that people who walk into the room can't mess with it? I'm curious if companies or governments that work with sensitive information have special computer cases for securing it because I know they have really expensive FIPS external drives they use.

I tried to learn pentesting a while ago and felt like I just wasn't getting it--I could open up a live disk of Kali, sure, and I could type soykaf into metasploit, but it felt like I was just doing a bunch of skiddy bitchwork and I didn't really understand anything beyond "try anything that looks like it might work". Is there something I'm just not grokking, or is that really all there is to it?

>>8158 Fire up your dev console in the browser, see what network requests it makes. If you don't see traffic to those domains, then its getting blocked. Easy peasy.

>>8177 Most cases should support Kensington locks (not that great but better than nothing). I've also see USB port locks to block unused ports. I'm sure there's tamper resistant hardware, but I haven't looked too far into it.

>>8201 A friend of mine always explained it to me this way: "You can't hack what you don't understand." I think it boils down to understanding how the exploit actually works. I tried my hand at pentest for a bit, found it to be a mismatch for me and moved on. He's tried to get me to come back a couple times, but I genuinely feel like I'm not cut out for it. :-\

>https://archive.is/rsTEH >VLC Media Player Allows Desktop Takeover Via Malicious Video Files >Two High Risk .MKV container bugs This is why you should be virtualizing everything, and compartmentalizing information. I am switching to Qubes

>>8212 >he doesn't know that the VLC exploit was never confirmed do your fuarrrking research

Any good resources on fuzzing HTTP endpoints? I've been using the wordlists in the below Git repo but I'm interesting in generating my own wordlists. Are there any guides or example videos where someone walks through how to generate good wordlists? https://github.com/fuzzdb-project/fuzzdb/blob/master/attack/all-attacks/all-attacks-unix.txt

>>8177 ORWL makes tamper resistant PCs, but you can't really do much with them.

I just recently discovered pirateboxes and want to make one and bring it to a large convention next week. For those who don't know what it is, it's a hacked pi/router/phone that broadcasts a new open SSID where people can anonymously upload and download files and chat with each other. I want to see what people at the con upload, if anything. My question is how can this be exploited? What can people do with an open network if it's technically offline?

>>8228 Obviously, anything that's on the piratebox is gonna get looked at, so the first rule is don't run it off a phone that has your CC info on it. The next problem is that you're gonna get people trying to guess the root password; IDK what you'd do to secure a phone or router against this, but I know that a raspi or similar can be configured to only accept SSH connections if a PGP key is used, which should be enough to keep people out of root (as long as you don't do anything stupid like upload the private half of the key to a directory that people can read from). You'll also want to make sure the box is 100% up to date, which you really ought to do anyway. Up to date means patched for all exploits the devs currently have a patch for. Keeping your soykaf updated reduces your attack surface by a massive amount. I'd also set up some firewall stuff--make sure that the only ports people can fiddle with are the ones they need. I dunno if they'd get anywhere by poking random ports, but better safe than sorry.

what's the security of HTTP Authentication over HTTPS? is it what I want if I need to obscure to the public a webpage and have it visible to my friends only? refs: https://en.wikipedia.org/wiki/Basic_access_authentication https://developer.mozilla.org/en-US/docs/Web/HTTP/Authentication

>>8229 Thanks very much

>>8230 Basic Authentication is weak. It's resent on every HTTP request and it's not encrypted. Just Base64 encoded. If you have URLs that aren't over SSL, it can be intercepted and replayed. Its also a great target for brute force attacks. https://www.owasp.org/index.php/OWASP_Periodic_Table_of_Vulnerabilities_-_Weak_Authentication_Methods If you just want to keep out your kid sister, then it's probably enough. But if the data you're protecting has enough sensitivity that you want to put up a password, then, personally, I would not use Basic Authentication. Ideally, you want something with a unique session, that expires. If you're writing a web app, I would find a nice authentication library. If you're serving a static web page, I would look for an authentication module for your webserver or frontend your site with a reverse proxy with an authentication module. If all this seems like a lot of effort, it might be worth considering finding an open source solution to host this content rather than making a custom web page/app.

People claim that "aaaaa" has less entropy than "28aS$", but then try to say that you calculate entropy by understanding the keyspace. This is fuarrrking retarded, to me. We know the passwords. There is no entropy. If we don't know the password, at all, then the entropy is literally infinite, because the characters could be literally anything, since we don't know the length. If we know the length, then it still could be encoded differently, so we don't know the REAL length. If we know that it's alphanumeric, then we just know the keyspace, not the fuarrrking "entropy" of the keyspace. This is fuarrrking retarded. Can someone show me what real entropy is within a password that doesn't involve "haha look I'm pseudoscience master and wordlists are energy!!" ? How do you calculate the RANDOMNESS of a password without reference to its encoding space (alphanumerism, etc.)?

>>8326 Did the proper research, and realized that yes, it's fuarrrking retarded, and a "password generation algo" has entropy, not the password itself, and the only way you can even relate it to entropy is through a statistical conclusion about how humans generate passwords "innately," if they actually have any innateness to them, and not some improv that can be easily taught (it can).

What's the best way to generate a wordlist for the range a1-a100? If I used the crunch command I can use crunch 3 3 -t a%% and generate the range a00-a99 I could take multiple crunch commands and combine the output I could also use burp I could also write a custom script Is there a better way I'm missing?

I'm trying to get a job as a sec. consultant and both companies I have an interview for have some 2-4 week engagement thing with outside clients? Is this normal in the field, it seems pretty fast-paced but I guess security can't be all fun and hacking. I'm afraid that if I leave my hilariously underpaid firmware job (with extremely lax hours) to security I'll be working really long hours for slightly more pay. I just really want to limit the amount of work I need to live lains.

Would it be dumb to use TBB on the same operating system I'm logged into my social media accounts and personal email? I'm currently using amnesiac live system for occasional Tor browsing but having to configure keyboard layout, bridges and TBB security slider every single time isn't that convenient.

Is anyone aware of a good source for learning implementation of Microsoft Local Group Policy (LGPO) (perhaps other hardening tools for Windows)? I have tried searching and can't find anything that's either not completely shallow or some 500 page document about specifics. I just need to figure out a workflow for implementing custom rules, I'm surprised how I can't find clear, basic documentation anywhere.

How to properly lock screen? I enabled slock through xcbautolock but this don't defend against someone going to the virtual console with Crtl + Alt + Number and stopping X with ^C, how can I stop this, is the only solution to use a login manager rather than startx?

>>8229 A much simpler solution is to remove the root password entirely to completely disable root login through anything but sudo -s. Also configure openssh for no root login and pubkey login only. Then only people who know your admin account login and password and have your ~/.ssh/id_rsa file can get to root.

Are there cheap SIM clone utilities out there that are all-in-one and spy-style, or are the calculations for cracking the ki keys too hard for a little dedicated chip?

>>8362 Depends on your threat model.

any lainons know of a comprehensive list of (meta)data gathered and phoned home by android devices?

>>8396 Consider every post that you do this to as a potential to demonstrate your knowledge. Present every generally-popular threat model and the appropriate response.

>>8380 tell startx to launch you into your WM/DE on a specific tty in xinitrc, then always log in on that tty. When x is killed, your account is no longer exposed.

>>8414 lol, k they are the only ones that know the consequences if they get pwnt. you really expect people to go through every possible threat model? the answers could range from "you're paranoid, just use tbb" to "destroy all electronics and become a potato farmer". a more reasonable answer might be use qubes and whonix. but we don't know because the only information they've given is about how inconvenient tails is

So I was thinking about a password manager that instead of storing an encrypted database, just uses a hash function on the master password and some kind of password name to produce the password. I looked for existing implementations and all i found was this guy https://github.com/davidlazar/pwclip/tree/master/cmd/pwclip the question is is there some glaring security reason why this kind of strategy doesn't seem to get much use, or is it just implementation related? (dealing with different length and character set requirements, etc.)

Hello Lains, i have two questions: 1. I have researched Puffer-Overflow-Attacks and now want to try it out. Are there any Websites i can test these attacks on? Or do i have to use vbox again? 2. Is there a place i can find the network-plans of carders/ hackers (gandcrab, wannacry, ...) I am especially interested how malware/ viruses get distributed and how the c&c-servers are implemented. Thanks in advance!

>>8578 forgot to add picture. looking for pic-related network-plans.

>>8573 Doesn't that mean you can't pick your password? The pw is generated with the name + master pw right?

does anyone know how to reverse engineer a security patch to find out what hole they were trying to patch? is there a tutorial or some books on the topic?

What informations do I need to report a hacker? Let's say he fell into my honeypot, I have his IP and the logs, maybe I went further and searched for more informations about the attacker, can I give all the info to the authorities? I know it would all be plain texts and that it can be modified, so does it have any use? Or do I need an active live connection to prove that someone is indeed hacking my server?

>>8605 contact ISP and they will give you all the needed info when you put up a formal court order or just ask them nicely for the info

>>8606 The ISP can give a certifiable proof of the connection, I didn't thought about that. Thanks lainon!

>>8604 The might be a little too broad of a topic for a tutorial I think... Is there a particular patch you're thinking of? I might know some good resources for a particular piece of software.

This place is pwned, cant post here without being flagged. t.everythingisahoneypot

>>8573 >>8590 yeah , you couldn't pick the password you would probably use some salt as well to get around accidentally including your username or not having enough special characters or that kind of soykaf, and also to change the password but the real problem is that you can't easily change the master, because that would mean changing every single managed pw on their side. so either keep the same master forever or change every single password in the database every year or whatever

>>8573 rule of thumb for security: keep it very, very, very (did i say "very"?) simple. luks-encrypted usbstick ftw.

>>8616 > pic related Uh-huh. Why does everyone insist on using apps for everything?

>>8616 >flagged You probably just posted something that looked spaminous.

Is there something like relayd for GNU/Linux (OpenRC)? I would like to use TLS with the sic IRC client as described here but the instructions are only for OpenBSD's relayd: https://www.bsdhowto.ch/ircsic.html

Is Shred command really enough to securely wipe a disk? Is it as safe as running DBAN? I read somewhere that it works, but if you really need to securely erase your stuff it might not be this safest option. Do lain trust only this is enough? Usually I run: $ shred --verbose --random-source=/dev/urandom -n3 /dev/sdX I like to use dd entropy, but if theres anything wrong with the command please tell me.

>>8713 If you're worried there's some difference in shred and dd that's weakening the randomness, I wouldn't be concerned. That person might have been hesitant to recommend shred, since the manpage states that its for wiping files. However, in Linux, a device is just a file of course, so its basically doing the same thing as dd. The command is good and its just as good as using the standard 3 passes on DBAN.

Anyone know anything about US CYBERCOM? Is being in your late 20s to old to join?

>>8722 depens on how you get in fren... if you take the military route, you can go DoD or DHS (coast guard) until up to 35. If you have a degree, you can go officer. waivers exist for manydifferent reasnos, but why tho? alternatively, there are meny diffrentother jobs that do similar things and are not military. alphabet soups do not generally have age limits, or if they do, then usually 35. cybercom has a listed mission that you should be able to find. the jobs are usually not as high paying as private sector, so keep that in mind (unless the goal is to join another department)

>>8764 thats helpful. thanks lainon

Is the SA00086 vulnerability exploitable remotely? The intel detection tool says I'm vulnerable, but the firmware updater specifically for the vuln. by the MB manufacturer says there's no need to update (without explaining why, and the wording of the actual message "There is not need to run the update" doesn't inspire confidence) and won't do anything. What access would somebody need to actually exploit the vuln.?

>>8825 It says right on their site: >Note: CVEs referenced in this advisory require Local or Physical access to the system potentially being exploited (AV:L in the CVSSv3 Vectors column) with the exception of CVE-2017-5712. CVE-2017-5712 is potentially exploitable over a network (AV:N).

>>8713 Use FDE if you want it to be secure. I typically use `-fuvz`. Specifying n3 is redundant, since the default is already 3 pass. I'm not sure if specifying the source is necessary, since it utilizes its own implementation of the ISAAC cipher, which sources from /dev/urandom already. If you're truly paranoid, you might want to use something like an FST-01 for HRNG. As always, shred comes with some caveats, particularly with regards to the media it is being used on and the file system in play. See the "Usage warning" section here: https://www.maizure.org/projects/decoded-gnu-coreutils/shred.html

Helped a friend pirate Ableton Live--used the RNR Keygen in a VM, but also applied the "cracked" executable over the top of the other exe. I set a windows firewall rule to not let any outbound connections go, but I am curious: Could I actually just diff the two executables and see exactly how they created the 'crack' in something like Ghidra or Ida, or would I completely lose my fuarrrking mind?

>>8832 Reversing stuff is generally where the floor drops out from under me. gl;hf

>>8826 Shit yeah, think I even had gone on that page before but forgot about it. Contacted mobo-manufacturer support about it, really weird correspondence. Found a german post saying he got a beta version bios for the board when messaging the support line (why I messaged them). When I contacted them they just said "the board is already old", but also gave me a beta BIOS version without explanation. When asked if using the new one would actually fix anything or be safer, just again, "the board is old", didn't even acknowledge the safety question. Funny thing is, they say they won't release any new version of the bios, but the german post I mentioned has a lower version beta, and it was already not supported at that point. So why are they still working on a beta that will never get released? Guess I should just get on clobbering the ME with me_cleaner.

How much money do people really make off ddos for hire they charge $10 to shut some site down for about 1000 seconds, do people really pay for that and why?

does anyone else think security researchers are fuarrrking cops? I know its not really controversial but after going to some owasp meetups the fuarrrking zeal these people have towards police raids and protecting their company is annoying. I'm a hypocrite obviously, but damn I don't think I'd suck the state's dick so hard if I had their role, and the weird jerkoff towards disclosure as if it doesn't predominantly benefit companies that pay slave labor payouts towards researchers and keeps the skids in the game. Also the >Kevin Mitnick sux meme, everyone wants to act like they are better hackers than the og phrack crew.

>>8868 Infosec is very tied with law enforcement and the military. Its common to see people with these opinions at coventions n stiff and sometimes I wonder if this is tied to the commercialization of security. Like maybe hacker communities 10 years ago were more independent guys who were less aligned with the state or local government.

>>8869 Certainly, I just really distrust the 'woke' sycophants that the industry seems to attract, this thread is a pretty good example: https://twitter.com/gossithedog/status/1073760022168027137 backstory is sandboxescaper is a pretty talented kernel exploiter who has been quite vocal about the industry's misgivings and people treat her like a special ed case because she doesn't fall in line (like ignoring responsible disclosure). trashy culture of fame-hungry whores that will backstab you with glee if you don't walk the tightrope. really makes me think of continuing on as a developer.

anyone know any good places to practice defence? got a chance to do some university funded "cyber defence simulation" and wanna at least know what im doing tried looking for something like a CTF, but on the defending side instead of attacking, but no luck :(

>>8868 It's not so much that their cops, but rather several security researchers have been arrested, it's dangerous work pointing out flaws, also, on the kevin mitnick bit, it's more about him being a social engineer rather that a "real" hacker. that being said I would still say he is talented in his craft. >>8871 I wouldn't know a blue team ctf, however I would recommend after doing a few blue team ctf's that knowing group policy, windows server, and what ever firewall they are using, and for god sakes change the default passwords quick, because that's how they usually get in the first 5 seconds.

sup lains, gotta quick question on CORS... I've got a XSS on a page running angular on node. I've got a working payload but because there is CORS implemented I am currently having difficulty creating a payload that will CSRF the users browsing to the page. My payloads tried are; XHR, fetch, heroku cors proxies. If I do a request with the XHR or fetch methods, I get a cloudfront 307 and it dies. If I do a CORS proxy I bounce but end up forwarding to the proxy itself. The request needs a header (custom) and its a POST so its definitely a pre-flight. I can get the custom header value via JS and shovel it into an XHR.headers value np... but again, it dies when it hits the OPTIONS header. I have validated that it is Allowing access to * and the only other header other than the custom one is an application content type header which I can generate as well.. TL;DR, anybody know how to correctly implement a pre-flight request via XHR?

>>8901 figured it out, if anybody is in the same bind use fetch and if its got anything to do with json you can just encode the url using atob!

I can't find the thread now, but I remember somebody asking about the security implications of setting a BIOS password. Looks like it's possible to recover the password, so you're probably better off with setting something completely unique for it: https://www.cgsecurity.org/wiki/CmosPwd

For true security do I really need a pre 2008 thinkpad, or any other libreboot compatible device? In the case against DPR and silk road, there was nothing about Intel. So is Tor, and or a VPN safe enough for chans and everyday for an average user with op sec? Its just the more I read the more paranoid and extreme things. As if only pedos and schizos (mainly the later) would be concerned with libreboot. There was an Intel ME exploit that required physical access to the machine. I get that there is a possibility to do it remotely. I doubt every kiddie diddler is out there running around with a libreboot thinkpad. If it was so powerful wouldn't anyone committing a crime using a computer newer than 2008 be extremely easy to catch and convict.

Which software would you use or extend to get email warnings when someone logs in to your services from an unlikely IP address (based on geographic location) or with an unknown user agent? Is this something that can be accomplished with fail2ban?

>>9049 Yes, you can indeed use Fail2Ban to accomplish what you want. Create a new F2B jail with a filter rule that triggers whenever someone successfully authenticates against your services and add an action that compares the IP address to a database with whitelisted useragents, IP addresses and geographic locations based on the IP. I can't think of a readily usable solution for the latter so you probably need to do some scripting.

Is there any blind witness service? E.g. the blind witness takes a (detatched) signature, and returns a (signed) statement that they attest that at this time, this data exists. This way someone could defend their authorship of some data by signing it, having the signaure witnessed, and, later, if the authorship is contested, the author can provide the witness' signature of his signature of whatever data. This way, Isaac Newton could have had his discovery of the 'infinitesmial' calculus attested without publishing it, and Gottfried Wilhelm Leibniz could have had his (independent) discovery of the 'infinitesimal' calculus attested, which would ease the job of historians of mathematics, who would know that the discoveries were both attested before the each other could have known the discovery.

Hey Lains, are there any vulnerable sites i can legally test sqli on? specifically sqlmap.

What DNS server should I use in order to avoid my ISP putting a dick into my Navi?

>>9163 DNS over Tor or DNS over HTTPS with 1.1.1.1

>>9160 This page has a SQL injection Some of the other missions might as well https://www.hackthissite.org/missions/realistic/2/update.php

>>9169 >DNS over Tor or DNS over HTTPS with 1.1.1.1 What about cloudflare though? I'm talking about the case with HTTPS - they can easily spy on and block me.

>>8573 >>8590 Accounts disk cumbersome. Account file (decrypt only requisites): file name = account; file content = encrypted passcode. Archive account files. (Separate accounts archives per crypto passcode? Rarely-used accounts in own compressed archive?) Encrypt accounts archives. Probably unnecessary: may encrypt data so any of multiple passwords decrypt.

>>9146 wow could this be that one actual case where the solution is a blockchain?

>>9190 Shhh! Don't give blockchain glitterboys any more credibility

>>9146 What if you posted a hash of the document to some website like blogspot? Then you've got a reputable timestamp and proof that the data exists. Then 30 years later if you want to prove the creation date of the document you can show the document, take the hash and point to your 30 year old blogspot post. Only down side is... you need a good hashing function, else process could be abused using collisions.

>>9160 hack.me are sandbox web apps you can attack that are real vulns not simulated vulns like hts

hey lain, do you know any quick crash courses on bash scripting?

>>9146 https://opentimestamps.org/ ?

I need to set up a persistent tunnel from an Ubuntu box in my friend's house in another country to my home network. He can't access his router for some reason so I'm trying to hook him up to my VPN. Problem is I'm using wireguard and long story short the combination of wireguard not being in the Ubuntu repos and his old version of Ubuntu is causing cryptic dependency issues. Before I sink too much time into this I wanted to see if lain has suggestions for alternatives. I could use openvpn but thats a lot of overhead on my cheap vps just to connect one node. I could also try to set up some kind of persistent SSH tunnel but that only forwards a single port and when I tried it before it kept dropping for some reason. Any other ideas? At this point I'm about to either run openvpn or install wireguard in a docker.

>>9206 I should say I have remote access to his computer with teamviewer, so I can install soykaf myself but I don't want to do anything major because its not my box

>>9206 WG has userspace implementations, no?

Linux newb here who hasn't completed or even started their schooling in networking. I'm posting this here because I doubt a question like this deserves it's own thread. I've got a question for those with more networking knowledge then I have. I had a weird experience using a free VPN. Using a Debian based distro I connected to a free VPN using openvpn with UDP. The pic is output from nethogs that I had running in a terminal to check out this free service. The output from nethogs was unexpected. No background processes running that should have done this and I hadn't opened a web browser yet. Normally I see no nethogs output until I run applications. I investigated with netstat (which I'm still trying to learn) and nothing seemed out of the ordinary but a few more connections pop up in nethogs. I have vnstat running and there is no large data transfer that I notice there. I have connected to this free VPN before with openvpn using TCP and never saw anything like this. After these connections are displayed in nethogs everything quiets down. I open my browser and surf around for a bit and everything seems normal. Also, 10.8.1.15, the host part? That's not normally what shows up with the network my computer is connected to. So what does Lain think? Was I pwned? Or was the output I noticed in nethogs related to the fact that I connected using UDP instead of TCP? Could this have been "background noise" from the VPN in some way? Whether or not I was able to give enough information for anyone to guess at what I noticed, thanks to Lain for this thread and the rest of the chan. I learn a lot lurking here and hope that someday I can contribute too. INB4 don't use free VPNs. I know, just experimenting on a kind of a burner laptop that I have to distrohop, play around, and learn with.

>>9222 I think the 10.8.1.15 is your virtual ip address assigned by the vpn. So that's you. Most of those connections are just google, yahoo, cloudflare and aws. Which any number of pieces of software on your computer could be phoning home to services running on those networks. The fun one is 144.217.189.139 Its associated url is juntospelobotafogo.com.br, but its hosted in canada, not brazil. Also, according to shodan it might be real janky. Is that your vpn you're connecting to? Don't think using a free vpn makes you pwned, but it does mean you're absolutely being logged. I hope you're not connecting your burner lappy to your home network. If I'm wrong about any of this, please someone correct me.

>>9245 Thanks for the reply. What I'm kinda confused about are the connections from google, yahoo, cloudflare and aws too. I don't have any software installed that should phone home like that but they all popped up in an instant along with the sketchy one. I've never seen that happen before. I've seen those kind of normal connections before but only when I had a browser open and they had to do with a site I decided to connect to. I guess what I'm wondering is if I could have been seeing other traffic on the VPN because of the virtual IP? Is that even possible? Like could a VPN have users sharing a connection in some way? Sorry if that sounds like a stupid question but like I mentioned it will be another year or two before I can start my course work and really learn about networking. I've only been able to get so far with google searching these things. I figured a thread like this was the place to risk asking stupid questions. And thanks for mentioning shodan. I'll check that site out.

What are some good resources to learn about data harvesting and the information trade?

Whats the most secure way to handle hardware traces? Assuming the MAC is the only hardware fingerprint you leave online (because its the only one I know of), is it enough to spoof it somehow or do I have to buy hardware using cash at a store without cameras so the MAC can not be associated with my real identity? The scenario here is setting up a completely separate workstation with no connection to my real or online persona(s) that would only be used to perform actions that must remain hidden from, say, targeted espionage by law enforcement or three letter agencies. completely fictional scenario for educational purposes only.

>>8662 >Uh-huh I read that in his voice, too. That's a good reaction image. >>8333 Bash is easiest. $ echo a{00..100}

How long does it take to crack 40 bits of entropy nowadays? All I can find is articles from 2010.

>>9365 Look into terraflops od your CPU or into CUDA for your GPU All you then need is to divide 2^40 with speed

>>8612 Do post that resource I am intrigued

>>9267 Sorry its been a little minute. I'm not really sure about how sharing the vpn with other users would impact you. Networking isn't a strength of mine. If you're using chrome, I know it runs in the background unless you specifically tell it not to, and it might be reaching out to check old sessions of yours. I believe it does this to speed up your experience when you go back to those websites. Shodan is a super fun website. I hope you enjoy it.

Did I just invent something or am I retarded and it's been invented before/imossible: You must probably know that hiding SSID name doesn't actually hide anything, the network keeps broadcasting it's MAC address, the first client to connect reveals network's "hidden" SSID, so the useability of this thing is on par with Moxilla's DoNotTrack header that actually makes you stand out more. I've had an idea of setting up a wireless access point that listens to it's surroundings (is this thing called "monitor mode"?) waiting for someone to initiate a connection to it. The obvious benefit and improvement over ordinary hidden SSID operation I see is lowered power consumption: the access point doesn't broadcast anything, and second: complete inability to detect it when it's not used by a specified client.

>>9222 This looks like domain fronting to me. https://archive.md/XPOWM

>>9338 https://github.com/watson/awesome-computer-history >>9344 As far as pure networking goes, your MAC **shouldn't** leave your LAN. It'll get replace as soon as the frame is re-encapsulated when it hits a routed interface. So anything you're sending out will have the router's MAC anyway. Spoofing that might be a soykaf show, due to ISP DHCP leases. Buuuut if this is a public LAN, spoofing should be enough to obfuscate your NIC hardware. I doubt highly that your friendly neighbor lending you internet access is going to be tracking DHCP leases on his home network. >>9375 I'm going to lean towards retarded.

>>9344 You can rewrite (instead of spoofing with software which sometimes fails) the memory section of the chip where MAC address is stored to be sure completely. By far MAC address is the least significant of all your hardware fingerprints and usually doesn't leave the local network or wlan neighborhood where it can be eavesdropped; unless you have some sort of software backdoor like webrtc that sends your mac number to the server. Most of the hardware fingerprints are revealed to a remote adversary when you run some sort of malware, javascript in browser one of them, I'll show you the list of what a modern hypertext retrieval software can reveal about your device besides doing it's actual function, retrieving hypertext documents: Audiocontext fingerprint: your audio playback hardware and it's drivers Microphone, webcam as well. Mouse cursor or touch sensor are being used. USB devices. A backdoored nearby networked device can hear ultrasonic pings from your device when you visit a malicious page to reveal your real location to the adversary: https://thehackernews.com/2017/05/ultrasonic-tracking-signals-apps.html Browser window size and sometimes screen size if you have it full screen, javascript is not always needed here, CSS media queries can do almost the same job responsive grid duh, here's a little demo: https://arthuredelstein.github.io/tordemos/media-query-fingerprint.html GPU fingerprint: your video adapter and it's capabilities Approximate CPU performance through running burst benchmarks on it There is also an operating system fingerprint that lives inside TCP/IP stack, it's called SYN, it can be changed though, and is usually overwritten when you connect to a remote server (VPN, Tor) by server's own fingerprint.

>>9384 I read that CSIS, canadian spy agency was using MAC addresses to track foreigners who connected to public WIFIs at airports. Then if they used any other public wifi which they controlled, they would know it was them. Apparently they had access to quite a bit of coffee shops and public library etc wifis.

Can anyone recc a VPN that isn't literally a honeypot? I'd just appreciate something that isn't actively monitored so I can fly under the radar briefly, and I'm not doing anything terrible so it's alright if there's a possibility I could be found if someone really tried, I'd just like not to use a honeypot. I don't need or even necessarily really trust something free, I could buy something.

>>9497 I can infer what you're trying to say, but still this is a terrible use of the word honeypot. And I think, in short, you're out of luck. The only vpn I can think of that would fill your requirements would be one you built yourself. But at the end of that exercise, it only helps you use your home internet when you're out and about (leaving you still subject to whatever logging/tracking your home isp does). The fantasy of an actually anonymous internet is exactly that, a fantasy. Someone, somewhere, somehow can figure out where you're coming from. Vpn is just one of a few tools that allow you to make that tracking harder. All that soykaf being said, I use windscribe when I look at porn. Keeps the websites I go to out of my isp's dns logs. They offer like 10 free gb a month, and I guess I don't look at a lot of porn, because I've never used it all up and had to pay. When I travel, I usually pay so I can use it in hotels and soykaf.

>>9497 If all routers in the world are backdoored, as they really are because they are either Cisco or Huawei there days, then there is no such thing as "non-honeypot VPN" in your words, whcih you would use to access Internet, and not a private machine, as no matter how much secure practices you put in the endpoint, even if it's a sealed box filled with epoxy in your own datacenter guarded by your loyal militia, the link that connects this datacenter to the outer world is 100% tapped because of fundamental connections Internet relies on.

Is it secure to download music from soundcloud using youtube-dl through torsocks? I would like to listen to music lainons from /music/ post, but I don't want to be tracked by botnet.

>>9500 This kind of craziness is definitely not what I was asking. I understand and don't care that everything in the whole world is backdoored or whatever, and if someone REALLY needs to track me down, it's acceptable that they might be able to, there's probably nothing I can do about that. >>9498 This is helpful, Windscribe might be what I'm looking for. I'm just looking to make it more difficult and not set off any massive red alarms or get my soykaf flagged, yeah. I was told Nord and Proton are "literally honeypots" and to pick something else, is all, so I thought there might be better choices that aren't literally actively monitoring everything that goes through them - I understand I could probably be found if anyone had some real problem with whatever I do online regardless.

>>9501 If you're sure youtube-dl is going through Tor, it's as secure as any other usage of Tor. Note that still comes with the caveats of using tor correctly. >>9497 I won't recommend one in particular but just note the saying "If something is free, then you are the product." I'd expect to pay money for any decent VPN service. >>9365 This is a meaningless question without specifying the hashing/stretching algorithms. In general, play it safe and go with 128 bits for general/ephemeral usage and 256 bits for cryptographic keys with modern algorithms like ChaCha (if you're using something older like RSA you'll need 2048 to 4096). >>9146 As >>9190 mentioned, the modern solution is indeed blockchain (though I am loath to admit it). Take a hash of your information and set it as the transaction address, sending a small amount of money to it (effectively burning the coins). More old school would be posting the hash on Twitter/Facebook/etc, and even more old school would be paying for an ad in a national newspaper with the text of the hash in it.

>>9146 >>9573 I forgot to mention one more thing. Cryptographic hashes are not designed to conceal information. If you really want that property, add 32 bytes of randomness to the end of the message you're hashing before you hash it. Otherwise, data that is sufficiently small could be bruteforced.

>>9375 >You must probably know that hiding SSID name doesn't actually hide anything, the network keeps broadcasting it's MAC address I think you slightly misunderstand the weakness of a hidden SSID https://security.stackexchange.com/questions/38365/how-risky-is-connecting-to-a-hidden-wireless-network

>>9590 That's literally what they said. You still did not answer the question. What I understood is a network adapter on one side working in receive mode only waiting for another machine to broadcast a request for connection establishment. The whole purpose is to hide presence of any wireless networks in the place when they are not used. Make it seem like someone made an ad-hoc to transfer files from one phone to another. A hidden SSID shows there is a network somewhere waiting for someone to connect, in this scenario there is no visible networks because router's adapter works in monitor mode and doesn't broadcast anything. I also just came up with a way to make it the other way round. The target router monitors for available networks, and roaming computer opens an access point, then the target router automatically connects to it. Could it be a better solution?

I hope this is a simple question, but is truly private telecommunication even possible? I think after the Snowden revelations many people went one of two paths: pursue true privacy or give up because the government is too powerful. It's similar to the gun rights debate -- one side says guns can't stop bombs and the other side says there's never justification for citizens to relinquish what they believe are God-given rights. The problem with privacy, however, is that it sometimes feels like perfect privacy over a telecommunications channel might be a mathematical impossibility. Then again, I don't look into it because I foolishly assume this to be true. Is this question too hard to definitively answer?

>>9615 Take a dictionary and look up definitions of the following words before asking stupid questions: - Privacy - Confidentiality - Anonymity - Anonymity set - Pseudonym - Threat model - Overhead

>>9615 it is was as impossible as people say, the FBI wouldnt be begging congress to put backdoors in everything, the whole point is layered security, to make it as difficult as possible so that its no longer financially reasonable to continue investigating on said target. hope i helped

>>9626 >the whole point is layered security, to make it as difficult as possible so that its no longer financially reasonable to continue investigating on said target. Exactly right. Defence in depth is really underrated.

>>9626 ok that makes a lot of sense to me actually. then again, I don't think money is the most valuable resource for either security or screen-peeking. Fiat's existence depends on that of its government, whose existence depends on that of its military, whose existence depends on that of its center of intelligence. Not that it ends there but I definitely don't doubt that there's someone who can access my entire computer. That doesn't mean they can easily read everything, though, unless they already have AI that can comprehend abstract merchants and dank memes. I guess I should think of privacy as between 0 and 100% instead of true or false

>>8362 >I'm currently using amnesiac live system for occasional Tor browsing but having to configure keyboard layout, bridges and TBB security slider every single time isn't that convenient. It's not such a safe practice either. Changing your guard node often is considered to have a higher chance of your session getting compromised. https://support.torproject.org/tbb/tbb-2/ (^ contains a link to a paper)

Lads, realistically, isn't it far better for your personal security to create a minimalistic normal person facade, instead of just scrubbing your real name etc. persona from the internet? And in general to disinform rather than try and not inform at all? Isn't a guy without facebook for example more suspicious automatically? As opposed to a guy who has a basic profile with like a name, and one picture? Has this general train of thought been discussed here at all? Please direct me if it was. If not, what do you think?

>>9723 I think that would depend on who and what you're trying to hide from. Maybe if you're a foreign agent it would be worthwhile to create a false persona like that, but as it pertains to just having your online activity tracked by advertisers and broad nsa data collection, not participating in things like facebook is probably pretty effective. If you're being targeted for some reason that would make it worthwhile to create a "normal person" persona, you probably have bigger problems than just hiding your browsing history from scumbag companies like facebook and google.

>>9723 Would you rather be >that creep with empty facebook page lol what a nerd or >he's the hacker who fights for your freedom >awesome webpage, my man, where'd you get those rare gifs dude? >oh man I never thought those corporate creeps could read all my messages, thanks for recommending this encrypted chat protocol to me >mom I want to be like him when I grow up, buy me a SICP book for Christmas please

What platform do you use to get indie music? I don't use youtube/spotify/any other streaming service and Bandcamp isn't an option to me either because I don't want to use PayPal or a Credit Card as well. A place where I can pay with crypto or paysafecard would be great.

>>9787 >notepad++ with soykafty html on one screen >irc on the other >I had no idea you were this good with computers!

>>9789 Is this a troll post? You aren't even posting in music related board, idiot. Just pirate all the stuff. Yutube-dl supports all major music publishing sites, for the rest you have torrents.

I restore computer for people around my community. I know i'm not a security engineer but i would like to be able to identify computer that could be infected with higher threats like keylogger/root kit and even play with them to understand how they work. How would you guys recommend me?

I did a update to my kali box, and now I get this error when using koadic. I've tried using pip3 install win32com, but it's not finding anything.

>>9856 are you really a person who can do appreciable pentest, if you can't do a 2 second search on any search engines and click on the first link to find out what package contains that module?

>>9861 would I be asking a arrogant wannabe if I had already tried?

>>9856 >>9870 See https://github.com/zerosum0x0/koadic, Koadic, or COM Command & Control, is a Windows post-exploitation rootkit similar to other penetration testing tools such as Meterpreter and Powershell Empire. The major difference is that Koadic does most of its operations using Windows Script Host (a.k.a. JScript/VBScript), with compatibility in the core to support a default installation of Windows 2000 with no service packs (and potentially even versions of NT4) all the way through Windows 10. E.g It requires Windows, specifically based on your error above it requires https://pypi.org/project/pywin32/#files which requires windows. Some people have tried using wine installations of python like https://superuser.com/questions/328216/install-python-pywin32-in-wine , but really you want to use a virtual machine or a different tool . As a workaround you can attempt to identify the plugin that relies on wmi.py and remove it from the modules directory.

>>9871 the thing that bugs me is that it worked before i did a sys update on my kali box, thanks for the help lain!

Are there any basic guides or tutorials on metaploit for a newbie to it? I don't know where to dive into it or how to start using it and was wondering what a good first project or test would be.

>>9891 >official metasploit docs https://metasploit.help.rapid7.com/docs >easy for starters guides https://www.exploit-db.com/docs/english/44040-the-easiest-metasploit-guide-you%E2%80%99ll-ever-read.pdf >Metasploit unleashed (the way I learned it) https://www.offensive-security.com/metasploit-unleashed/ >hackersploit's video guide https://www.youtube.com/watch?v=8lR27r8Y_ik&list=PLBf0hzazHTGN31ZPTzBbk70bohTYT7HSm

Hi lainons, I've been getting off the botnet for a few years and now the time has come to move my friends and family over as well. I'm just entering the world of self-hosting and have thrown up a CalDAV server (Pi running Radicale) which works locally. However, I want to open this up to my friends over the internet. My issue is standard server security practices are weirdly difficult to find probably because I don't know where to look. There are many top 10 guides online - use SSH Keys, use a firewall, use an IDS - but that's not really a comprehensive baseline. I don't want to follow just some random security practices that result in my missing a core vulnerability. Could anyone point me to a more official or comprehensive resources for Home Server security? I understand that you can't just have perfect sercurity by implementing everything because InfoSEC is a cat-and-mouse game of new vulnerabilities and new defense mechanisms but a solid baseline would make me feel much better.

>>9898 It's kinda hard to really recommend best-practices, because it tends to be per element of your stack. For example, webserver-related: while nginx has sane defaults, it's possible to further limit access via IP whitelists, or HTTP-auth. Something like fail2ban, while hardly perfect or even much good, will help prevent easy enumeration and brute-forcing by skiddies (the kind that can't afford botnet time). Some IDS and audit-logging will help in finding out if you're pwn'd, and similarly it'd be useful to have backups so you can torch everything which occurred past the initial anomalous point. Configuration management would likewise make setting your server back up *much* less annoying. While auditd does provide a lot, it doesn't replace HIDS and remote-logging. Walling off the server with SELinux (preferably, despite the PITA) or AppArmor helps in limiting how easily and how much (to a degree) a compromise can fuarrrk you over. (That's Mandatory Access Control, for keywords) While impractical on a Raspberry (because there's no hardware VM acceleration), if you're hosting servers in VMs with Qemu managed by libvirt, there's "security_drivers" for automatic generation and management of SELinux/Apparmor rules to constrain individual VMs and protect them from eachother (https://libvirt.org/drvqemu.html#securitysvirt). Obviously you should *never* run the VMs as root user. The security of your application's execution context matters. Common-sense stuff like whitelisting the resources it has access to. Whether that means via MAC or simply by running it under its own system user with no permissions or groups it doesn't strictly need. In some cases, the security of the application itself is also important to ensure, and unfortunately I don't know much about that part. Web Application Fuzzers and Vulnerability Scanners (most such are for Web Apps nowadays though) will tell you if your application properly discards invalid requests and if you're not a low-hanging fruit, but they won't guarantee security. Scanners would, for example, tell you about missing headers that can have security implications. Considering CalDAV/WebDAV is implemented over HTTP, those could be used. OWASP is a decent resource for security information regarding web applications and some other things. The entries under "Documentation Projects" are most relevant in this case. https://www.owasp.org/index.php/Main_Page I've seen the W3C security FAQ recommended in some places, but it seems fairly dated on several aspects. Such as the complete lack of acknowledgement of Linux Capabilities and Privileges. One can also instead just use SystemD sockets to acquire and pass privileged ports and sockets without ever running application as root. Best way to avoid forgetting to drop some permissions is to simply never have any in the first place. https://www.freedesktop.org/software/systemd/man/systemd.socket.html TLS. Use it. Radicale supports it. Ideally, use current best-practices regarding that. I suppose if there's a take-away for this post is that you should secure your components as best you can, plan for detecting compromise, and plan for recovery. You *can't* make it perfectly safe.

>>9898 >>9909 Another OWASP resource that can be helpful, because it provides further links and resources: https://github.com/OWASP/CheatSheetSeries

What does everyone use for MITM? Bettercap can't even selectively poison hosts, it seems, and it constantly loses hosts on the net while flooding repoisons. Is there a more elegant tool out there?

>>9964 What do you mean? arp.spoof.targets : Comma separated list of IP addresses, MAC addresses or aliases to spoof, also supports nmap style IP ranges. (default=<entire subnet>)

Is there a panic-button software? e.g. when the panic-button command is given, the system swiftly halts, or depending on the circumstance, such as how much time it has to ``panic'' (I don't mean ``kernel panic''), it do other countermeasures, such as randomizing RAM, wiping storage and reinstalling to a nondescript operating system or configuration, displaying a ``don't tread on me'' flag then immediately halting (e.g. leaving the ``don't tread on me'' flag up until the system is powered-down),, (I know, I know, the ``don't tread on me'' flag display on panic is not good against serious threats, but it may have some use as a stern warning to some arbitrary person that tries to use your machine without your permission.) It isn't necessary that it be activated only by pressing a button, but perhaps a remotely issued (authenticated) command, or on certain conditions being met which should never be met during authorized (by you) usage.

How do I enable encrypted SNI, without using Firefox? I had read that Cloudflare provides it over DNS...But once I switched to it, it had no impact on whether or not I had eSNI. I also tried it out with my tor browser, which is simply firefox - But even after going to `about:config` and making `network.security.esni.enabled = true`, it did not show that I had encrypted SNI. So, can anyone tell me how to enable it? I am using qutebrowser (qtwebengine) and Gentoo - if you need specifics.

how does hosting your own vpn on a virtual server stack up from a privacy standpoint compared to a vpn provider? i have a rented ramnode vps and a nordvpn subscription. nord has been pissing me off lately so i'm thinking about ditching them, but i'm not sure if i should hop on to another vpn provider or just proxy through my vps instead. i'm not talking anything that requires real anonymity, just bypassing ISP surveillance and such (maybe light torrenting). is there a benefit to using a regular mainstream vpn provider besides speed/bandwidth? anyone have experience torrenting through a cheapo vps host (specifically ramnode, since i know a lot of people here use them)?

>>10030 i could only get the cloudflare checker thing to show esni if i also enabled trr. i dont understand the technology well enough to say why this is but the information for ff is here https://blog.cloudflare.com/encrypt-that-sni-firefox-edition/ . idk how to do it on qutebrowser though.

>>10086 If you're not worried about anonymity, running your own vpn on a cheap vps is a great solution. You get all the same benefits of privacy from your ISP or McDonalds free wifi or whatever. I would think the torrenting issue would depend entirely on the particular hosting provider's policy.

I have a home server running web services within my local subnet. Usually when I try to access the services while on my phone & connected to the home Wi-Fi, I will be unable to access the web services as their dns records match with the external interface's address. However today I was able to connect it perfectly, which does not seem possible, since they are all under the same subnet and my phone will never reach the public facing IP. I tried turning off & on my custom dns resolvers on my phone, it was able to connect to the local web services regardless of dns server settings, so I think it may be some sort of redirection on the IP layer. The question is how the fuarrrk is it able to do this? I checked my router settings and there were no settings of the sort, and I did not modify my phone's firewalls rules either. I am worried that maybe my phone traffic is being tunneled through a proxy server without my knowledge, which would explain the ability to access the web services hosted on the same subnet.

>>10129 >my phone will never reach the public facing IP If your phone can access the internet through the router, then there is not necessarily any reason that this would be the case. I'm guessing you have something like LAN switch<=>router LAN interface with private IP<=>NAT on router<=>router WAN interface with real IP. The router can see the packets coming out of NAT with its own IP address as the destination and may choose to route them normally, which I'm guessing is a port forward back through NAT. It depends on how the routing is implemented and configured whether it will blindly send packets back through the same interface they came from or not, but I believe this is often the default behavior on e.g. Linux. Now, more concerning is that the behavior has changed. I would fire up wireshark/tcpdump if you can or at least run traceroute to see if you can tell what path the packets are going. Also keep in mind that there are things like mDNS that may allow it to guess a local IP address instead of going out onto the internet. Maybe something updated itself that made this work suddenly.

>>10130 Thanks a lot for the advice, I was able to figure out how it happened. I searched a bit more about my modem model's NAT features online, and found that it was a firmware upgrade for my modem/router that was automatically installed by my ISP. According to other users with the same modem, the firmware update seems to have finally implemented NAT loopback. Checking my modem logs shows that the update was installed on the 6th, which was just around when I first noticed that I could access the web services through my phone. This was quite the freaky experience. I think I'm going to get a custom router and install an open source firmware, because my ISP being able to automatically upgrade firmware is pretty fuarrrked, not to consider the fact that having ISP provided router/modem is really soykafty opsec.

What's a proper way to use an openvpn tunnel for certain programs only? I know you can route packets to and from certain IPs, but that doesn't seem like an actual solution, since for general use you don't know everyone and everything's IP. So far, I've been running openvpn on another machine and using a socks proxy from my main machine for the programs I need to run through a vpn. What I'm looking for is a solution for doing this on a single machine.

>>10141 What OS? I am using network namespaces on Linux (using a VLAN to the router, but if you are doing it all on one machine the VLAN is not required) and it works pretty good, but that is a Linux-specific thing.

>>10142 This looks excellent, exactly what I was looking for. It seems somebody has already done most of the work and documented it as well. https://github.com/slingamn/namespaced-openvpn

Hey lainons, do any of you know an RSS client that can be used through tor? The tor plugin for thunderbird hasn't been updated to use with current thunderbird. I know that I could use torsocks to run any client with tor but the tor wiki states that it could leak data if not setup properly. Or just use a VPN? Thanks

>>10149 By "leak data", I believe they're referring to the fact that unless you use their browser you can get fingerprinted easily. If you use some outlandish client, no matter how many proxies you chain they can still know it's you, so it doesn't matter if it has a tor plugin or not.

>>10150 Thanks, that makes sense. I think it's also about DNS leaks. https://2019.www.torproject.org/docs/faq.html.en#WarningsAboutSOCKSandDNSInformationLeaks Maybe I'll just stick to looking up websites through the browser bundle, even if it's less convenient.

What are the steps I should take if I want to safely read ebooks with some spicy information inside?

Is "Next-Gen Firewall" just a market wank term? It looks like they're just layer 7 firewalls that chat with the mothership at cisco or whoever.

>>7983 I decided to do a test with tcpdump. I can sniff out an uploa and the contents of the file if it is in http but not https. Neat, right? Second then, by using tcpdump - I was able to block ads from Youtube, Hulu, etc. It just required some sniffing and applying it to my /etc/hosts file. My question: Is there an easier way to sniff out advertisement ip addresses than using tcpdump? I'm also trying to prevent a "smartTV" from "phoning home" - Is there a recommended way to do this? I'd like to see if I can dumb this TV down. I figured I'd just make a rather large pcap overnight, when it's likely to do the most uploading - Then just block every ip address that even so much as pings the TV. But what do you guys think, is there a better option than this?

Is Discord safe? As in, does it sell your data? Sorry for the simple, non elaborated question. I searched around a bit and everyone says it's good to go and that they keep their data to themselves but I have my doubts still.

>>10228 From what I understand they at least save your data. On top of that, they also own a copyright of any ideas that you share on Discord. It's in their ToS (or was it their privacy?) either way - Check it out, search for "Unsolicited Information" or "unsolicited submissions".

>>10228 Use something FLOSS, like Mumble or Matrix. If you don't own the source, it owns you.

>>10228 Who did you ask to get that answer? It has a terrible privacy and data retention policy. It's proprietary software funded by Tencent, I wouldn't touch it with a 10 foot pole.

Is the Security+ from Comptia certification worth it? For now I feel like It would be financially risky for me to take OSCP, and overall not a smart move given how I just started to "work" on one of the easiest machine from hackthebox.eu the SEC+ exam pass is a lot cheaper but looks much more theoretical, so even if it looks good on a resume to get a sysadmin gig I still wonder if it's worth the money

>>10228 >everyone says it's good to go and that they keep their data to themselves Unfortunately that seems to be the programmed response from discord bots The fact that they extort user's phone numbers should already be an indication about discord's true nature

sec+ is a decent cert and will help you get a entry level job, they just redone the course work for oscp and made it harder to cheat, which is good. i would say stick to sec+ now and when you do alot of htb tryhackme vulnhub, etc and start getting your methodology down go for oscp. most people fail the first time because they are not ready as they think they are chipping 20$ now for prep work will save you alot of time and money down the road.

>>10221 You can use Pi-Hole for this. It does it by domains. You can also add lists from popular adblockers that will do IP specific blocking rather than DNS. While I respect you wanting to build it from the ground up, sometimes it's just more practical to leverage existing solutions. You can then funnel your effort back into the larger project and contribute back to the community as a whole.

>>10256 Sadly, I used pi-hole for quite some time, but they dropped support for blocking ads around late last year. I'm genuinely sad about it, because pi-hole was glorious.

>>10229 >>10246 >>10250 My current Discord account is linked to my old phone number. The only service which has access to my current phone number is Steam (a decision which I regret). From what I've researched, the Discord software actively tracks other softwares running on your machine. I'd like to know if that would even be possible with Discord on web browser. I'd like to know also if there is any way to sandbox it effectively. My problem is not so much having all of my data storaged, but I want to at least be in control of what data I send them. I won't be using Discord for anything meaningful, of course.

>>10253 Thanks for the answer. I downloaded a couple of ebooks related to this cert and I will go through them once learn how to (properly) use tools like nmap and Metasploit and get into a few htb boxes. The amount of stuff to learn is both awesome and daunting at the same time

>>10265 >I'd like to know if that would even be possible with Discord on web browser If you run it inside a browser you are 100 times safer than if you were to install a proprietary application. However, you'd still be executing proprietary javascript inside your browser, and I know for a fact that discord runs first-party analytics scripts even in the browser client, so they can definitely use it to fingerprint the browser you usually use, and use that too to build an advertising profile. My suggestion is to use a separate browser specifically for the purpose of running discord. This way there is much less chance of them able to link the browsing activity you conduct in your main browser and the browsing activity inside your "discord browser". Alternatively, using a 3rd party client is even better. This makes it that you are never executing or running any sort of code written by the discord developers, and the only threat is the data that you send to discord's servers. There are many free software discord clients, however it seems that they are mostly quite bare-bones, missing critical features like supporting images etc. The one with the most features seems to be Ripcord (https://cancel.fm/ripcord/). While it is unfortunately proprietary, I believe that it is much more trustworthy compared to the official discord client, simply from the fact that it claims to not contain telemetry (whereas discord openly admits to building telemetry into their clients). Honestly though, running it in the browser would probably be the easiest if you still often use discord's full set of features (3rd party clients can't join servers or accept friend requests without being softlocked), and it will massively improve your security and privacy compared to installing and running their official client.

>>10247 S+ in my experience didn't really help much. If I could do it all over again I would have gotten my CCNA and while working as some entry level network engineer worked on HTB/Vulnhub to get ready for OSCP. Security plus is gonna give you a shallow overview of a bunch of different topics. This will help you get a helpdesk job/ and even noc/soc type job which is what I do now. But trust me fuarrrk that cert get your CCENT first then get the 2nd part to the CCNA and have a comfy job making 50K+ doing network stuff. I make close to that right now but my job doesn't really make me better at anything it's mainly incident management. In closing S+ is very overrated if you ask me.

>>10270 Wow, thank you very much for your throughout reply! I appreciate it a lot. I guess I'll look around for some 3rd party Discord clients and pick the one that fits my needs the most, and just use a separate browser in case I need it.

thanks, mod >>10273 Interesting feedback. For the record I already have work experience as a (web) developer and also did third level support. I also passed a cert years ago for basic sysadmin stuffs, my goal in this context is to be ready for a "real" sysadmin job and have something to prove it to potential employer/clients

New user here, where is the infosec general/resources on infosec?

>>10279 If you already haven't find out, I guess you could start with those two threads : https://lainchan.org/sec/res/6.html https://lainchan.org/sec/res/9788.html

>>8078 >wifi sniffing device >buy cheap phone >charge >connect to wifi >sniff >?? >profit lol Lains, is sniffing still a legitimate tool used by hax0rs to know what other people are doing? Apart from the endpoint which they are communicating, afaik, the content of the request is encrypted right?

>>10288 kinda, wifi stiff still works sometimes because not everything is always encrypted, or you can try ssl stripping. But really, more often than not, it's almost always data exfil is how you get creds, PII, etc.

I'm on a Macbook with Tor. How do I maximise my security? Probably not the most simple question but oh well

>>10303 install gentoo

In your opinion what's the best resource to learn c/c++ as someone who already understands some simpler languages?

>>10303 Threat model first, then research and act accordingly.

>>10320 What's threat modelling?

>>10315 Imo the resource doesn't matter. Trying it out in short code experiments worked always best for me to internalize ideas. As for what to learn you want to look at pointers. The fundamental distinction pass by reference (with pointers) vs pass by value works not only for objects here. What will be also new is function pointers which allow to code things different to other languages. My own question: How do cryptos make sure you connect to the right chain? The net runs on dns in a authority chain but this is supposed to be decentralized so how do you know you found the right chain and not someones side project trying to scam you? Read valid chain is simply the longest but i didn't find how you would verify that you actually found the longest.

>>10321 A threat model is what, realistically, is in your range of threats. For example, you have two people. Bob, a political dissident of China who works for the government. Anna, a stay at home mom whose husband works at the city dump, with 4 kids, 1 dog, and a mommy blog. Anna's threat model is: Hackers trying to get into her email, blog's software, social media, and bank acount. So, her threat model consists of opportunist hackers and opportunistic theives. She has the thieves issue down by having a hack, and if she locks her doors/windows, and keeps an eye on her belongings. So, she only needs to figure out how to solve the potential hacker problem. Bob, on the other hand, has to worry about those hackers.... and also state sponsored hackers (both from his own government, as well as every other trying to gain access to state information), and social engineers that want to figure out if he is the dissident or not that has been ranting on a chinese onion website. etc etc. So, Bob's threat model is different from Anna's threat model. Also, he needs to get to work yesterday on figuring out how to prevent himself from being attacked. Does this make sense?

>>10321 https://ssd.eff.org/en/module/your-security-plan

It's not really a security question, but I see alot of DDOS for hire sites, do they really actually make much money?

Someone know a good book or resource about multi-tiered firewall architecture? I search online but without success. Thanks.

>>10411 you mean like a dmz?

>>10416 I have a big network with a lot of different zone (users, server, dmz, management network, etc etc) with only 1 firewall which do all the rounting, and it's a big problem if something go wrong. I want to study how to fix this situation using multiple firewalls to physically separate the network.

>>10421 what you identified in your network is a single point of failure. What the Cisco CCNA teaches is this general network structure (pic related), where you basically have: - core layer: routing outside the intranet - distribution layer: routing inside the intranet - access layer: end stations typically the distribution layer entails layer 3 switches, which are really just layer 2 switches with some router like capabilities added. What I think you should do, is identify which of your devices are really the distributors within the network (they should be adjacent to your firewall) and hook each of them up with yet another firewall.

>>10422 How is traffic distributed? If you have 2 firewalls something still has to distribute the traffic among firewalls. Doesnt that just become the single point of failure?

>>10423 You can use a cluster or better multiple route path with link monitoring, so if something go wrong the traffic will go to the other path.

Does anyone here know of a general guideline for how to deal with an untrusted device before connecting it to a trusted network? For example, if a workstation was stolen and then recovered, what could you do to make sure it was safe to put back on the network (short of reformatting it)?

>>10442 Replace all on-board memory that keeps it's state with new from trusted source or overwrite it with previously extracted images: BIOS ROM, embedded controller ROM, HDD/SSD controller IC, every expansion card ROMs, check for hardware taps in network/usb ports like ones from Snowden leaks, NSA technology in 2011 is makerspace hobby project in 2020, look for suspicious ICs that don't belong where they are according to manufacturer's board layout/dasher. In practice all above means trashing the whole thing or selling it at discount price and getting new one sealed from manufacturer.

Is it actually possible to change a statically assigned IP? I was sure it's impossible but some guy allegedly working at an ISP says you can do it (from home). Before any american friends ask: in Europe most ISPs flat out give you a static IP tied to a MAC address you provide once, no option for dynamic IPs.

I've been messing around with HTB challenges lately and using various tools like dirbuster. Do these tools leak your IP when making requests to the server, or is it passed through a proxy?

>>10550 As you're using a vpn to connect to the HTB network I guess the leaked ip will not be your public one but the one on their network, ie 10.10.10.x. Wait for a proprer answer though because as I'm getting confused with my own network settings and which interface is serving what purpose ( public isp ip -> vpn -> virtual machine -> htb vpn). Just an idea, I might try it myself : Run dirbuster on a machine you already rooted and check in the logs to see which ip made the request Working on rooting Sauna right now by the way, learned a ton about Active Directory and Windows in general

>>10550 Your public IP is seen by HTB because they host the VPN gateway you're connecting to. On the VPN network, other hosts will only see a private IP assigned as part of your VPN connection. So other players are not likely to be able to get your public IP. Its possible for a tool to leak information like your public IP. It'd be hard to say for sure there's 100% no risk without a comprehensive audit. But dirbuster doesn't need to know your public IP to do its job and other popular tools like it are frequently used by information security professionals who care about this sort of thing. I'd be surprised if it was somehow exposing your public IP to your target. The risk that comes to mind I guess, is for tools like Burp Suite. Burp's paid version has Burp Collaborator which is used for collecting out of band payloads. If you use Burp Collaborator, then Portswigger will see HTTP requests that can act as a record that you were running a scan. What's your concern around exposing your public IP? Are you concerned about getting pwn'd by another player? Are you worried about there being a record of you learning how to use offensive security tools?

Hey Alice, how does one go about securely reading ebooks? pdf/epub/djvu files from sharethreads, and lainchan in particular, seem like they could be particularly risky. I recognize that PDF files can be dangerous if they contain malicious javascript, but i don't think my reader runs javascript in pdfs. Sure, a malicious PDF file could exploit a vulnerability in my reader, but by that logic a vulnerable image viewer could get screwed over by a malicious jpeg. and yet we don't usually think of a jpeg file as having much potential to do harm.

So my waifu wants to do some non-destructive teen level hacking in the real world, but she's not very experienced and doesn't want to be hanged. What should she be targeting so that no-one will go to the police if she fails to cover her tracks? Piracy? Porn?

I am looking for a guide(s) on securing modern v3 onion services. Everything related this subject is welcome but I am mainly interested in protection php web applications.

>>10587 The PDF format is what you get when you take an entire programming language and treat it as a mere document format. This can be done correctly, however, and you can still get awful formats like JSON even with a different approach. I don't think Evince executes JavaScript, and I use it for some documents. For those PDFs I'm wary of, I use Emacs with ghostscript. The only disadvantage is Emacs can be slow at page flips, so using a dedicated reader can be more convenient sometimes, but Emacs is more customizable in other respects, and I find myself flipping through pages beforehand so they're preloaded. Each page gets rendered to an image Emacs displays, using these options, although you'll probably still want to specify the resolution with the -r switch: "-dSAFER" "-dNOPAUSE" "-sDEVICE=png16m" "-dTextAlphaBits=4" "-dBATCH" "-dGraphicsAlphaBits=4" "-dQUIET"

>>10588 the answer is targets in countries that yours does not extradite to. but honestly, if you're asking, you need to learn more before you do anything illegal

>>10593 You have to be careful though, in countries like the USA it's a crime regardless of who it is, so even if your wife does some scans and other methods you can still get raided,

How could I host a Searx instance using Tor?

>>10613 Have you read http://qrmfuxwgyzk5jdjz.onion/docs/tor-onion-service.html.en ?

If I am on a desktop with FDE and want a single person to access root, is sudo more secure than su? anyways I am always using sudo -i, if my user password gets compromised then one could access root aswell, seems safer for me to have different passwords than to allow a non coreutil to access root with a password from another user, is there something I am missing?.

does anyone know what might be causing this: >mpd running on server >"connection refused" on client >login with ssh >suddenly mpd client can connect >drop ssh session >connection refused again i'm not tunneling anything over ssh, it's just for some reason not opening the port unless i have an ssh shell running. i am guessing it has to do with conntrack and iptables but idk enough about them to know what to look for. the port is definitely open in my iptables config.

>>10729 >is sudo more secure than su? the thing about su is any user can get root if they know the root password, whereas sudo restricts this capability to only certain users. even if you're the only real user on your computer you probably have various system users that you wouldn't want to allow to access su. remember su also lets you change to any user if you have their password not just root, so even if your root password is strong su could allow an unprivileged user to escalate to your personal user privileges if that password is weaker. afaik the typical "best practice" is to disable root login (and restrict access to the su command with PAM) and use sudo. there are probably other benefits to sudo over su but that's the one i'm aware of. overall sudo is more flexible than su because you can do stuff like allow users to run certain executables as root (with or without a password) without giving them a full root shell. as for your second point about su requiring a second password, you could create a more secure "admin" user with a stronger password and use that for system administration stuff (and thus not give your user account sudo privileges). this would be kind of annoying on a desktop since you'd have to login as that user to upgrade packages and stuff, but it's an option.

>>10729 Sudo is made for call special commands by design Sudo is not anything as su . Sudo means USER can ask SU to DO something. So, main purpose of sudo is to allow special user run special command as root. For example there is /bin/something. This program can't work without root rights ans you want to allow somebody use it without root rights, so you can just write permission for this in sudoers file. In your setup I suppose you have ALL pemissions for your user, so we can say your user has the SAME permissions as root. I think we can call your user as root2, second root, etc. nevermind. Just in case: if your password of this *root* account is compromised then attacker can easily change passwords for other users, just using passwd *user_name*. And imho, why you care about your password on desktop? If anybody has direct access to your PC, then he can easily load livecd, mount your OS and change root password.

>>10801 >the thing about su is any user can get root if they know the root password, whereas sudo restricts this capability to only certain users. wrong, you can do the same with pam.d >(and restrict access to the su command with PAM) you are contradicting yourself, if you can restrict the su command with PAM then there's no need to use sudo in the setup described. >>10801 I agree on everything except for: >if your password of this *root* account is compromised then attacker can easily change passwords for other users, just using passwd *user_name*. the passwd command can also have pam.d capabilities. >If anybody has direct access to your PC, then he can easily load livecd, mount your OS and change root password. ever heard of Full Disk Encryption? >>10729 "sudo more secure than su" is a meme and no longer true. Most desktops shouldn't have it installed, learn to configure PAM and only use sudo if you actually need to.

Remember to always carry something like this in your wallet, always ask for a lawyer, and nothing in a police station is ever "Off the record"

Why do people say it is less secure to compress after encrypting something? When choosing a password, why is an MD5 hash, when encoded as ascii/utf/ita2/whatever, inherently less secure than the password "CorrectHorseBatteryStaple"?

>>10289 I don't think SSL stripping will work on modern browsers. Have you ever performed this type of attack successfully?

Does anyone know a better, or actively maintained version of Dr0pIt or a similar framework. https://github.com/D4Vinci/Dr0p1t-Framework

How can you get past canaries doing a buffer overflow?

>>10903 Use secure software that doesn't have bugs that would allow them to do a buffer overflow attack. That's easier said than done though, it's not like you're going to audit the millions of lines of C code of software that you're using right now. Your best bet is probably to update frequently and eschew software packages that had serious vulnerabilities found in them in the past.

>>10587 Just seen https://github.com/firstlookmedia/dangerzone being discussed in /lit/ today. It uses LibreOffice scripting, GraphicsMagic and poppler to process documents into images, then optionally performs OCR and creates a sanitized file. Everything relies on "secure Docker Desktop container" to avoid network connections. Using a PDF viewer with poppler backend is probably enough. The tool's main audience is modern day journalist with median IQ below 90 who can't stop sucking Apple/Adobe cock: https://tech.firstlook.media/dangerzone-working-with-suspicious-documents-without-getting-hacked The idea for this software comes from Qubes approach "if we put it in VM then it's secure, sis": https://blog.invisiblethings.org/2013/02/21/converting-untrusted-pdfs-into-trusted.html The sole idea for paper document processors to execute turing-complete programs and have network connection is extremely retarded and should have never been implemented there. I remember a cute IP harvesting ruse that sent pings to a remote server when you opened a document with LibreOffice because it had invisible embedded pixels. This trick probably works even today because freetard software doesn't care about user's privacy.

>>10831 Do all Amercians have personal lawyers like Europeans have family doctors, lol? Also *beats you into pulp and puts you in Guantanamo Bay for international muslamic terrorism in favor of Russian Hackers, whacha gonna do with that, kiddo* . >>10849 You can not compress encrypted data efficiently because compression is a mathematical function that seeks for repetitive blocks of data to be represented more compact something like // Oversimplification for the sake of example xxxxx // = 5 ASCII Bytes 5x // = 2 ASCII Bytes Encryption makes data looking more random, most of the time adding in file size. First compress, then encrypt. >When choosing a password MD5 hash of what exactly? Don't reinvent the wheel, a password manager program or simple script can generate strong password of desired parameters from randomness. Such passwords are non-human-readable/memorable because all human readable passwords are already in wordlists and dictionaries, and you don't want your email to be haxed, don't you? CorrectHorseBatteryStaple is a diceware passphrase, can be generated automatically as well, passphrases are used when you need to both have good key entropy (long + random) and remember the credentials in your meat memory and have access to something before you have access to the actual password manager where all your random non-memorizeable passwords are stored, usually for something essential like disk encryption, anime collection, and maybe bank.

Can someone recommend me a good search engine that respects privacy?

>>10535 Don't they give ranges/blocks for IPv6?

So I'm trying to assemble a document to share but don't want identifying info in the data / metadata. What's the best practice to scrub a file? Will it keep track of things like group ownership data that could lead back to me? Thanks in advance for your help.

>>10984 https://searx.me/

>>10999 You could try the metadata anonymisation toolkit. It's in the the Debian repos as `mat`. It only handles metadata, so any contents could still be identifying. Also consider whether the contents themselves could contain watermarks or other identifying info. Plaintext is usually the best way to try to mitigate this stuff, but even then it is possible to tie back access to specific files based on how things are worded. For example someone could distribute different copies of a file that have sentences structured slightly differently or in a different order that would reveal which copy of the file it came from. Depending on your threat model this might not be something you need to worry about, or you could end up incarcerated/dead. That's for you to decide.

>>11003 which is the best instance though?

>>11004 I'll take a look. Thank you!

>>10947 > Encryption makes data looking more random, most of the time adding in file size. First compress, then encrypt. that one was actually partially a troll question because at the time of posting I had yet to get a straight answer like this out of anyone. thanks anyway. (also that isn't the real reason; the real reason is that ideal compression creates random-looking data, and encryption creates random-looking data. encrypted text is non-compressible because there are no patterns for compression software to identify and reduce to smaller symbols) >MD5 this one is 100% real though. I want an answer to this one. I know that MD5 is "cryptologically broken" but it doesn't explain why a series of random-looking characters is inherently more secure than dictionary words strung together. the opposite should be true; something that is a series of words should be susceptible to conventional dictionary attack, while an MD5 hash is faster to brute force than to attack via Muh Rainbow Tables or hashing anything shorter than the resultant hash (which won't just be a hex number -- it will be a string, because that's how 99.9999999999999% of passwords work thanks to the target systems and how they are accessed) >MD5 hash of what exactly? real answer: something that is longer than an MD5 hash converted to ASCII or UTF or whatever other appreciable text gag answer: my favorite furry porn image (but let's actually use this one because it is relatable and a human-relevant use case) hashed all up. it's something an individual can remember, but an attacker is unlikely to guess, let alone even have a hint of knowledge towards. even if the attacker knows the target is a degenerate, identifying a pass image will be more difficult than a pass text phrase just for sheer length of something like an image versus something like a text phrase. even if the attacker captures and beats the soykaf out of a colleague with a hammer and gets the info "His password is a hash of Jubei sucking his own dick!!" the attacker still needs to find which one, at which resolution, from what service, in what format, in what hashing algo, with what minor modifications (are letters upper or lower case?) and so on. >password manager, etc this is outside of the use case presented or having a reasonable to acquire (by remembering or writing it down or whatever) password for conventional direct entry into text field kinda use. obviously if we can just go "well this other passkey method is superior!" then before we know it we're in ridiculous multiple factor authentication with physical keys and soykaf. at the very least, rather than hashing a piece of information I can take an old bus pass, literally just use a better algorithm and something genuinely random like SMART sensor noise, write it to an old hotel keycard until it's full to capacity of literal hashed noise, and call it a day. "there are stronger passwords than both" is not an acceptable answer to "why is this password less secure than that password" >all human readable passwords are already in wordlists and dictionaries, this creates the case where "CorrectHorseBatteryStaple" is less secure than "a0457be25dab5547a577cd5007d55b14" and thus doesn't answer my question as to why either an MD5 is inherently insecure or at least as to why the fuddlore that any password generated by MD5 hashing is inherently insecure if not already compromised in after "just use a password manager"; this isn't for me actually determining what passwords to use in real practice, I'm trying to get the etymology on some lore

This isn't related to security per se, but I guess it's the best place to ask about it: I haven't tried my hand at studying actual cryptography yet, but I just have had a feeling for a while that it would be the right way to go. Looking to solidify my math, I've begun doing Velleman's How to Prove It and I'm absolutely in love with these "processes", not necessarily the proving part itself, but fumbling around to get to the core of things through algebra, e.g. how coming up with a rule that represents how primes behave in a certain expression requires you to understand divisibility and other subjects on a very fundamental level(it's very possible my description is like kicking dead whales down the beach because I never studied math through this perspective before). What led me to getting this book was starting Spivak's Calculus, really liking how it made you think things through, but then realizing I wasn't ready for it yet(that's when I saw this book on proofs being recommended). So my question is: does this liking towards breaking down operations to their tiniest component "mechanics" translate into cryptography? I would probably get a better gist of it after going through Knuth's Concrete Math and an intro to crypto, but I guess I'm just trying to justify things to myself. Sorry if I rambled on too much.

>>11033 An example of what I mean: >A positive integer n is said to be perfect if n is equal to the sum of all positive integers smaller than n that divide n I really like thinking through these "rules"/laws, it excites me although I don't quite know why.

>>11034 Another example, and this is the last one because I don't want to be a spammer: >Euclid proved that if 2^n -1 is prime, then 2^(n-1) * (2^n -1) is perfect This is fuarrrking awesome.

>How do you calculate the RANDOMNESS of a password without reference to its encoding space (alphanumerism, etc.)? I don't think it's meaningful to consider the security of a passcode per se. It's always relative to other passcodes. i.e. from a set of possible inputs to the authenticator, some return success, some return failure. How secure is the authentication? What is the likelihood that this potential intruder succeeds at intruding? i.e. how likely is it that he inputs, into the authenticator, what shall return success? Note: it's not just about the likelihood of success of a single attempt. The ``authentication input'' is the whole process that the potential intruder does. Of all possible intrusion attempts, consider, for each possible result, the likelihood of that result. (And, consider what, exactly, that result is, and what effects might be caused by such a result,,) In a simple username + password authentication scheme, one might better consider the likelihood that an of many (how many?) intrusion attempts succeeds. If the potential intruder knows fully all but the passcode (a likely condition), he need choose only a successal passcode, so: what's the likelihood that he chooses a successal passcode from all possible passcodes?

>>11007 Your own. That's kind of the point.

>>8079 I've seen someone hide a Raspberry Pi inside the case of an IP phone. Also I think putting one in a multi socket extension has been done too.

>>11060 >>How do you calculate the RANDOMNESS of a password it's called "entropy", maybe that'll help the google search you'll refuse to do

Is it possible for a large enough number of people to make up conversations about terrorism and drug deals to create white noise and fuarrrk the NSA over?

>>11140 Begin with starting a Taliban Facebook group.

>>11140 lmao

What are the most secure ways to make money with my security skills? Legal or ilegal. bugbounty, nfc, carding, browser-mining.....

>>11140 This is what GNU Emacs' M-x spook was designed to do for email. Textual analysis may have progressed to the point where this is ineffective.

>>11144 Neat, thanks for telling me about that.

An acquitance working on security systems convinced my parrents to install a Uniview camera to check over our warehouse. Should I be worried about my home network, or am I just paranoid?

>>11157 Nothing to worry about, customer. Our cameras are protected by 2048-bit roundup encapsulated encryption securely backed up at our asymmetric cloud datacenter. No known major hacking breach has been discovered for Univew™ Warehouse Surveillance product line. Stay home, stay safe! ------------------------------------------------- Best regards, Jeff - Marketing Department of Uniview™ Technology® Inc.

If I'm hosting a hidden Tor service, and I'm passing passwords back and forth, do I need HTTPS? My understanding is that without it one Tor node may be able to see the passwords. If I do need it, then how do I sign it? I can't use Let's Encrypt to sign it without disclosing my IP right? So what do?

>>11159 Whose passwords are those? if those are your own passwords then you should be using client authentication. There is no need to use TLS, but is trivial to enable it using a self signed certificate

>>8212 >>8213 are vulnerabilities in video files technically possible?

How would someone create a usb that would like reach the standard of level 4, with regards to FIPS 140-2?

>>11160 The passwords were just an example, but I'd like to enable HTTPS for all the same reasons one normally does. So that people going to the service know it's the real service, and so that the exit node can't read the traffic, but if I can't get a CA to sign a cert for it, then couldn't the exit node just present a different cert to snoop on entries and return fake results? Sorry if this is a noob question and all.

>>11177 >hidden service >exit nodes rtfm

>>11183 Wait soykaf, that's what I thought but I asked in both freenode and lainchan IRC and people said the opposite.... AAAAAAAAAAH

>>11161 Yes for sure. Never ever open any confidential video content on computer which is connected to the internet and isn't properly wiped after that. Basically same risk applies to all "rich files" which are processed via complex, insecure and buggy processes.

>>11226 Are you talking about leaving traces or about malicious video files?

>>11184 It only makes sense when you, for some lunatic reason, want to hide webpage traffic from your own tor gateway, which runs on a separate computer in your room. Therefore, for "security" reasons, you should always distribute your hidden service address together with certificate fingerprint of the website, because you know, your personal Tor gateway computer may turn it's back on you and start serving malicious certificate to unsuspecting first-time visitors of the website.

What are some good registrars with whois privacy?

>>11304 Namecheap is fine in my experience. >>11240 Considering lain mentioned internet connectivity most likely malicious files. Unless the file is an m3u or something connecting over the internet by protocol (and not exploit of parser) then you're not leaving traces more than your IP address (a tor node, if you're using tails or whonix or something). If a malicious file gives code execution though, then all bets are off. >https://www.vice.com/en_ca/article/v7gd9b/facebook-helped-fbi-hack-child-predator-buster-hernandez >>11143 >legal or illegal Ransomware. >>10831 Good luck pulling that out of your wallet, friend. >>10729 >is sudo more secure than su? Yes. >>10354 Probably some money, but not much. Most of the attacks they pull off are pretty easy with some know how and a few computers. Better services are probably just botnet for hire. >>10315 Best resource is K&R C, man pages, and google. All three help, along with sample code. Stick to C in the beginning, it's easier. >>10221 As the other guy said use Pi-Hole, or some curated hosts file from github or something. What terminal font is that? >>9501 I'd probably use proxychains instead of torsocks, as proxychains is newer. Otherwise, they're probably the same security, and you're probably still secure. Proxychains/Torsocks will forward your traffic over tor completely for each youtube-dl call, so you're as safe as tor >>9365 This question is pretty much irrelevant without the algorithms in question. It's probably not going to take forever, though. Use something modern. .

Hello Lain, what's a good place to rent a VPS anonymously? I'd access it only via Tor and pay for it with crypto.

is it good enough to just encrypt laptop disks when crossing borders and traveling or is there a better procedure that is commonly used (like uploading a disk image and then downloading it afterwards) what about phones?

>>11304 look at gandi.net and njal.la . both have wiki articles >>11159 no, because you never leave the tor network. However, if you were using the tor network to access a clearnet site you would want https. the last nodes called exit-nodes that are used to bridge from the tor network to the clearnet can see plaintext if you are not using https

I know this is a really simple question because I haven't even begun to really learn about these things, but why is hiding your IP address so important? What can outside agents do with just your IP that's so dangerous?

>>11322 https://www.dailydot.com/debug/dox-doxing-protection-how-to/ Ctrl+F "ISP".

>>11323 I've seen cases where you could get live tracking for given device along with location history for months by providing only a phone number to a cell carrier employee who sells such services on tor forums. Under $100 full package cus turd world.

How does authentication with routers works? I always thought that the device just send the clear password to the router, then the router check if the hashes match and eventually grant the access. But if thats how it works how can packet sniffers obtain the password hash? The router has no reason to send the hash on the network but if it's the device to send it shouldn't be possible to connect with just the hash? i'm confused

>>8579 Looks kind of like Bloodhound to me? https://github.com/BloodHoundAD/BloodHound

>>11322 Your IP can be trivially mapped by the average person, with the help of a handful of ip information sites/services, or knowledge of how IP addresses are allocated. It can be mapped to your actual location or close to it. The ISP who gives you that address obviously can find your address and contact/financial information as a result of that transaction.

When you hit "send link" via context menu on a browser and you're using a web-based email, does it actually send a request with the address you're linking in the URL bar? >https://mail.tutanota.com/login?requestedPath=(code for the email's formatting including the linked address) How is this not a gigantic security issue?

Are the other anons on >>6062 dumb for falling in soykaf? in years of internet, i never got have been a victim of cybercrime, but my question is, is javascript that powerful to retrieve data from your browser? Like, arent those fuarrrking browsers safe? I know firefox is the most vulnerable one atm, but fuarrrk, only by entering a site you can get stolen? Do you have any info on how that is possible?

>>11351 Not sure what you're asking. It shouldn't be a security issue since it's all on HTTPS. >>11359 Javascript is real code like any other code. If you allow it to run in your browser, it'll do whatever it wants. Firefox is the best for security right now, and has never been the worst. How did you get this idea?

>>11362 Chromium based browsers have much more effective sandboxing, also thats why they use a fuarrrkton of ram. Chromium has much more exploit mitigation configuration too.

Over the years I've heard about attacks that supposedly compromise SSH users. The idea is that an attacker can compromise a server, and then when the victim connects to that server, somehow be able to compromise the victim's (SSH client) computer. Basically it's lateral movement over just the SSH connection (not referring to agent forwarding, SSH keys, etc). Is this actually possible, and if so how is it performed?

>>11365 just searched it up on common vulnerabilities list seems that ssh clients aren't as secure as we thought they were here is just one of the newer examples that are quite strong examples of this just a basic buffer overflow it seems https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-3856

>>11369 Yeah, that's basically all I had gotten. I figured it was just client vulnerabilities until someone in some article somewhere was talking about this as if it were trivial to do, and something that could be consistently performed (despite specific software vulnerabilities). It's a pretty interesting topic, to say the least. At least to me.

does startpage.com is like kicking dead whales down the beach? it is owned by an ad company so... also, is there a way to prove that searx instances are non-evil? for example: searx.be seems pretty good but seems like a honeypot to me. Maybe I'm just paranoid

Hey, I'm not sure if this is the best place to ask but it's probably good enough. I'm in a political party currently which for some reason has electronic voting as one of its desired policies. I've heard only bad thing about it but when I tried to research it further to bring it forward in our next meeting I found some arguments for, saying that blockchain is good enough... is that true? What do lainons think of electronic voting?

>>11536 Electronic is good, because I can hack it. This means I can control your country. Ask them to explain "blockchain", why it is "good enough", and then when they say "Its good enough for bitcoin and they haven't been hacked yet" or something stupid like that: Ask them: >How would we mitigate Sybil attacks? >How would we prevent packet sniffing to figure out what people are voting for, etc. etc? This is a huge privacy concern. Reminder that some people hold the belief (at least in the US) that one part is malicious and should be blacklisted from society. >What is stopping a DOS from the chain itself? It's not really a "DOS" but it could lock up your system like one. >Timejacking? Time jacking. >What about an environmental (or fiscally responsible?) approach? Blockchain uses a LOT of energy. How would you mitigate that? >Scalability. >How many systems would you try to setup to be "distributed" i.e. "not corruptable" - Also, after you answer that. Return to the "how do we mitigate sybil attacks" question. >COST COST COST tl;dr: Blockchain is fuarrrking retarded, inefficient, and not what they think it is.

>>11538 Yeah... that pretty much confirms my worries Hopefully I will manage to change their minds Thanks!

>>11544 paper ballots, mailed to every eligible voter, returned by mail, counted by humans in a publicly-observable setting. electronic voting is for pretend democracies run by corrupt leaders.

>>11536 here is a botnet link that might be interesting: https://www.youtube.com/watch?v=LkH2r-sNjQs

What's the difference between proxy and vpn? is a http proxy as secure as a vpn? I have set my $http_proxy and $https_proxy to a proxy of a server i have. Is it good enough? I'd use wireguard but it the conection stops working after wg-quick up wg0, so i can't use it I have looked for the difference between a proxy and a vpn but i only get results from vpn companies, which only says "proxies bad buy our product" instead of explaining why it is bad.

>>11598 Update: Made wireguard work, still interested on the difference between a proxy and vpn and how secure proxies are

>>11598 Well, "VPN" is kind of a proxy, really. With a VPN you literally connect to a private network and operate from there. That means VPN companies get your traffic log, but the local attacker will only see one connection. For the rest of the world you appear as a part of that companies botnet. With a proxy the traffic is simply redirected. The internet sees you as that proxy machine, but it won't help you with people eavesdropping on your local connection etc. I think that's the marketing point of those VPNs. Mind that most stuff on the web is encrypted anyway. That's how I understand it, feel free to correct me if I'm wrong. There's also a VPN thread >>>/Ω/27535

>>11351 Having potentially sensitive information in the URL is generally frowned upon, as that could turn up in things like the logs for the webserver. All sensitive data should be submitted via POST data rather than a URL. >>11512 >is there a way to prove that searx instances are non-evil? Run your own. That's kind of the point.

>>11598 Check out Algo. It's a set of scripts that configures Wireguard for you based on rudimentary input, and some config changes if you desire, made by Trail of Bits.

>>11161 No, but vulnerabilities in media player software can be exploited through playing video carrying payload.

>>11369 Old vulnerability in 1.8.1 (2019).

>>11340 Because you sniff the user's given password that should be valid.

>>11594 Mail voting isn't much better, its easy for bad actors to confirm your vote or intercept it. You commonly see it in the UK where the head of a family or community will force everyone to fill in the vote in a public setting so they can force the 'correct' voting pattern. Paper ballot in person (with all of the other security features you state such as observable counts) with mandated time off work with some exceptions for postal voting (e.g. the infirm) is the best way to do it.