@TerryChia Well, crap. Guess you just need to do it the old fashioned way. Write answers that get up votes from 14 people, or questions that get up-votes from 28.
Catti is a former employee of Infosek XML Inc.she feels she was wrongly terminated and wants to hack into her former company's network. Since she remembers some of the server names, he attempts to run the axfr and ixfr commands using DIG. What is catti trying to accomplish?
You work as a penetration tester for Kaizen Security Consultants. You are currently working on a contract for the state government of India. Your next step is to initiate a DoS attack on their network. Why would you want to initiate a DoS attack on a system you are testing?
Is there any way to measure scada systems security. any specific methodolgy ?
just wanna know is theres is any particular audit checklist to examine SCADA systems.
kindly post your answers. thanks
@TerryChia not really. A lot of sites have debated on requirements for homework. Putting rules on homework only serves to spark debates about what is homework. The sane way to cope with homework is to apply the usual quality control.
@TerryChia WE HAVE A POLICY AGAINST BAD QUESTIONS. HOMEWORK ARE "BAD QUESTIONS" BECAUSE THEIR VIRTUES ARE IN MAKING THE STUDENT THINK, NOT IN THE ANSWERS THEMSELVES.
Blame Pekka for this answer, he put me up to it ;-) . Enough cats, Pekka?
Yes, we need something linkable. The FAQ is an ideal place for this, but there are lots of other similar things that can go there as well. We don't want to bloat the faq, too few people read it already. Still, this par...
CEILING CAT IS WATCHING YOU PLAGIARIZE
3
CEILING CAT WILL FEAST ON YOUR SOUL. AFTER HIS NAP.
As with most things - it isn't about the tool, it is how you use it.
Take nmap for example.
Beginners to the tool or script kiddies might run scan using the default option.
nmap 192.168.1.0/24
The default behavior for nmap without specifying any addition flags would be to perform a syn s...
I'm new to the realm of HTTP requests and security and all that good stuff, but from what I've read, if you want your requests and responses encrypted, use HTTPS and SSL, and you'll be good. Someone in a previous question posted a link to this app http://www.charlesproxy.com/ which shows that it ...
@TerryChia we undoubtedly have questions on the topic, but I can't find an exact dupe, only threads that would be good references for further information
You are running known exploits against your network to test for possible vulnerabilities. To test the strength of your virus software, you load a test network to mimic your production network. Your software successfully blocks some simple macro and encrypted viruses. You decide to really test the...
( Ec-council ECSA Certification) all question i am asking are for learning purpose. Why is it essential that security analysts know Cisco routers inside and out?
@JeffFerland maybe he's reading the transcript? (Hello Karmic. You MUST acknowledge your sources. And you really should make some attempt at solving these exercises by yourself.)
@karmiccatti Hi Karmic. We're having issues with the quality of questions you're posting. Copying (plagiarizing) questions directly is not appropriate for our site.
Using Ubuntu 12.04. is there any way to hide a running process ? That process shouldn't' display in system monitor,top,htop . There is no problem to remember the process id (PID) so observation of the process can be done easily .but i want to hide the process completely . is there any way ?
@JeffFerland you wouldn't get it, it's on-topic where it is
If I link to a question without saying anything else, treat it as “this question might interest some of the denizens here”, not as “this is a migration request”
@Gilles I'm so not building a hash table of who means what :P
Off to go organize the rest of the thing I haven't taken care of since moving in and see if maybe I'll actually get internet service today instead of hanging out on my phone.
@JeffFerland But it's simple! When I say “Humpty Dumpty”, I mean “it's a beautiful diurnal isomorphism today”
and when I say ‘When I say “Humpty Dumpty”, I mean “it's a beautiful diurnal isomorphism today”’, I mean oops, look at the time, I have something I should be doing
I just got a new job - 40 datacentres, global presence, and building new website from scratch, and I am looking for such solutions, have tried already few, will try this one too
like CI etc
The company everything what they make is opensource
Now I am looking to take over the world; by building self-sentiment network
This is not paranoid, actually there are many companies and governments doing the same
It's up to date research subject
Nimbula has features of it
Self-sentiment network works the way, that the communication between the nodes is very fast, hence it can process large amounts of jobs, like information coming from left side of brain to the right
It's a long path, just like from cloud to cloud
And it's asynchronous too
And by connecting this kind of network to the global internet, and having e.g. 100M viewers per year, and make system understand the content (like youtube does), add language and other layers, you can see in real-time that it's sentinent
And with this, I can predict future events, so I know what it's going to happen
And it's not paranoid, it's advanced research
But nobody except me ever have seen that, because I am still anonymizing the data
As per Rook advise
Hence I believe NSA does have sentinent network too
Such website, has great marketing potential, because it can tell you a lot about your users and their behaviour in english
And can predict lot's of stuff, mostly sales
And it's my own proprietary research
Same system is on the TV - it will be logging what do you watch, and based on that it can hack into your mind
And works much better then web advertising, because it does understand what's on your mind much better
That's why I look for lot's of security, because I have it a lot in every project
And social network websites are excellent for this job
@CodesInChaos there is DNSSEC almost working, it should be sorted out by any time, and there is nothing to stop you from using it for name=>key resolution over internet
I would kill for working DNSSEC, because there is so many bugs because of it
Somebody should speed it up, most of the domains works ok, there are just two or three missing, but the biggest - gov and org
@CodesInChaos If I want to be sure that the water distributed by my home city is fit to drink, I would like a report from an independent analysis lab. Should I expect the report to come out of the faucet too ?
The only links between X.509 and DNS are: 1. with no DNS, no Internet, thus no download of certificates and CRL 2. the client looks for the server _name_ in the server _certificate_, and that name happens to also be the part which goes through the DNS to actually know how to contact the server
First link is more about DoS than validation: break the Internet, and communication does not work.
Second link is at best coincidental. And, anyway, in a SSL context, the server sends his certificate to the client, so when the client looks at the certificate, he already knows how to talk to it.
@CodesInChaos There are several ways...
I have seen some CA ask for a specific DNS entry
i.e. they send a challenge (a random value) and expect the value to appear as a TXT field in the domain.
This demonstrates control of the DNS
without any action or awareness from the registrar
The client wants to match two things: the name as displayed to the user and the name in the certificate. This is what validation is about: customer who wants to talk to Amazon sees "amazon.com" on his screen, and wants to be sure that he talks to "amazon.com"
That the same name is also an entry point into a name resolution system is technical and unconnected to the validation business.
For what it's worth, I don't care, and, more importantly, SSL does not care how the IP packets flow between client and server. Poison the DNS so that "www.amazon.com" resolves to your address, and things are still safe, as long as you forward the packets to the true Amazon server.
By "name displayed to the user" I mean "the one in the URL" (presumably the one he typed, except that people no longer type, they click).
@CodesInChaos Yes, precisely. Match between the name in the URL and the name in the certificate. Resolution of that name into a IP address or whatsnot has no impact on the security of SSL. Communication is not even required to be IP-based (SSL works over a bidirectional tunnel of bytes, and does not care about IP addresses).
But there is still the issue, does the legal entity "Microsoft" own the domain "microsoft.com". And the only way to figure that out goes through the domain registry, directly or indirectly.
@CodesInChaos Note that neither X.509 nor DNSSEC addresses this issue.
And the domain registry does not really, either.
Actually nothing guarantees that microsoft.com is indeed the property of Microsoft, except that we somehow assume that Microsoft would mightily strike at whoever would try to do otherwise (and, indeed, it has happened).
The best you can hope for, with X.509 or DNSSEC, is that whoever signed the public key allegedly attributed to microsoft.com also collected some data which is sufficient to trace back to the actual private key holder.
And that trace always goes through the domain registry in some form. So you already need to trust them. CAs are useful for making a connection to a legal entity, but that's only a second step.
What I want is that the chain between key and domain is as short and strong as possible.
@CodesInChaos Giving the power to act as CA to the people who already act as DNS sure makes things shorter (less people involved) but it does not necessarily equates with stronger, and this does not necessarily equates with safer (for you !)
CAs are cool for things like EAV certificates, where they also create a mapping to a legal person, but IMO they're useless for simple domain certificates
it all boils down to this: why should the system which maps hostnames to IP addresses be the same system than the one which maps "server names" (as seen by human beings) to public keys ?
DNSSEC solves a distribution problem which was not a problem (SSL servers and clients already have no trouble exchanging certificates), and this "solution" implies that whoever will map names to IP addresses will also have to be the entity which verifies key ownership
@CodesInChaos Key ownership is hard because you have to define what an "owner" is. It is easy to validate that "whoever is talking to you right now" controls a private key. What's hard is to validate that a given key is controlled by Mr Bob Smith (legal entity, can be sued if needed).
Verifying that "whoever controls a domain" and "whoever controls a given key" are the same entity is relatively easy, and CA already do it (the "challenge" above), and does not need in any way collaboration of the Registrar.
@CodesInChaos Yes. So what ? In what does it imply that the guy who remembers the IP addresses of the name servers for domain y must be the one who puts his seal on the "key x to domain y" covenant ?
@CodesInChaos Certainly not ! What says the DNS that is to be trusted in that case ?
Also, mind the details: adding a challenge value in my domain means that I have control of the name server -- the same name server that is known by IP address by the Registrar.
It is still my name server.
The people who grant me access to my name server are... me !
And the registrar could decide to move the domain to a different nameserver temporarily, demonstrate control of it, obtain the cert from the CA, and switch it back
@ThomasPornin registration and certification are very closely tied: who owns the domain, who serves data about the domain and who is the public face of the domain are closely tied. What is a separate matter is address resolution
Identity management calls for a central authority… but that's not PC
@CodesInChaos Ah, now we get to something: yes, Registrars have a lot of control over the Internet and are ideally placed to game authentication protocols -- which is a very strong reason why we would prefer to deploy public keys.
This shows that the challenge-in-domain procedure is not sufficient to achieve the kind of security we wish in our name-to-key mapping.
A big part of the CA business is still to gather identification data which could be used to make perpetrators suffer.
Claiming that registrars should be given general CA power because they already have a strong power of nuisance and impersonation (should they elect to use it that way) is akin to saying that when criminals are too powerful we may just as well call them "policemen" and be done with it.
Personally I believe that each top level domain registry should be a trust root. When you buy a domain, you tell them your public key (and optionally your real name, as a means to recover the domain if you lose your key), and they public the mapping domainname=>public key. And courts of the appropriate jurisdiction can force-transfer domains, which will also be published.
I recognize that, historically, monarchy has often worked that way (the strongest makes the Law, ultimately). But I do not mean that it is a model to pursue.
@CodesInChaos Well, there is a way to prevent the root DNS and registrars from impersonating who they wish: build an independent PKI, with unrelated root CA, and distribute X.509 certificates... the very thing that you advocate removing, precisely.
If you look at .com, verisign currently as full and total control over it. They can create certificates for any .com domain, and they can take anybodies domain away, because they're the registry.
The only thing that adding additional CAs that can create .com certs changes is reducing security
Of course you still need to combine that with some kind of log, containing any certificate every published, to keep that CA honest. But you need that in some form anyways
@CodesInChaos Hey, that's my point. Verisign is both a PKI (issues certificates, as a root key in Windows) and a registrar. Validating keys, and mapping names to IP are important services and I would be happier if they were in different hands
The PKI companniesw are geo localized on the English speaking countries, like south america, australia, us and uk, while the domain I guess mainly resides in US :P
I have helped to build one PKI company in central Europe myself, for public use, and ppl use it via website and browser generates the key, and this makes the transaction and document download.
So this way it doesnt go out of country and the keys are in the control of the website owner, so who needs that PKI any way - and the connection is via IP number - BGP - no domain involved
While DNSSEC is probably not optimal, it essentially takes your interactive challenge "Demonstrate control over the DNS record" and turns it into a non interactive one "Put your fingerprint into the DNS record"
@CodesInChaos And, in the same time, it implies that the CA job must be done by someone who is either new to it (not good), or someone who already does both and thus does not need it to be formalized any further (the case of Verisign).
@CodesInChaos So what you are actually requesting is not really a merging of CA with TLD per se, but removal of a number of crappy CA and a fresh restart with only a few (presumably competent) CA, a situation which could (hopefully) be obtained as a by-product of switching to DNSSEC ?
That's what I understand from what you say about centralization and the power or registrars: that giving them CA power would not break the system anymore than what it already is, and thus we can do it if only for an interesting side effect.
@CodesInChaos I think it can be fairly said that it is quite clear that you want that. What I dispute is the justification: that it would increase security.
You always need once central authority who does the name administration. And everybody else, directly or indirectly, refers to that authority to figure out who owns that domain.
There is no way around that part, it's inherent in a global naming system.
Guys, DNS is a global system, there is a DNS server running in every language in the world almost - so you can have in each country whatever you want, and regarding .com and .net - these belongs to US apparently
Similarly, if I want to map a name to an IP address or get some casual information on who may have presumably bought a domain, I ask the registrars.. because they are the clerks.
It does not mean that I trust the registrar.
The registrar is not the ultimate definition of the truth in the matter of domains.
they are - they operate the domain protocol - they can make any operation on these objects, including the history, and legally they are responsible, but you can claim domain in court
who else is? You have judges who can force registries in their juristiction to force-transfer domains. But apart from that, the registry is the ultimate authortiy.
And in practice everybody, including the CAs asks the registry.
For the non domain parts of the certificate, it ultimately boils down to ask the state in where the person is a citizen/company is registered, and for the domain part it boils down to asking the registry
For the domain part, the CA which ask for identification do not really care, although they prefer to do a verification (e.g. the challenge-in-domain procedure) if only to trap typographic errors.
What the CA guarantees is that "this key is really owned by someone who owns that domain", where "guarantee" does NOT mean "we really checked it", but rather "if this is false, then we know who to blame and we have proof for that".
This is the difference between a CA-for-business (where legal retaliation is everything) and a CA-for-spy-networks (where a priori safety is paramount).
The CA "for the Internet" operates as a CA-for-business, and that's rather logical since most of the needs for CA over the Internet is indeed to protect transactions.
@CodesInChaos For anything business-like (e.g. every time I buy something from Amazon), I really prefer the second kind. It is my protection...
For the rest, I don't see why I should relate to an external entity. E.g., when I use ssh to log in my server, I do not use any external PKI, be it DNSSEC or X.509 or anything else.
@CodesInChaos Actually, I presume that registrars themselves will not be over-eager to assume the CA role if it implies any kind of additional liability. Verisign will want to do it because it is already their job. I am not sure about other registrars...
In that case "We know whom to sue" is out of the window entirely, since I like pseudonyms. So we're back to a simple map human readable string to keys.
Essentially we have two separate problems: 1) Map human readable, unique strings to keys. 2) Map keys to real names/ suable entities
@CodesInChaos For emails ? To some extent, this begs the question: if I do not know who you are, what kind of security can we define at all ? If I send you an email, I already do not know who will read it...
For emails (and also other medias, like this very chat interface), what we want is continuity: when I send a message to "CodesInChaos", I want it to be read by the same person than the previous messages to "CodesInChaos" (whoever he/she may be)
@CodesInChaos Identity Based Encryption is a mathematical solution to this problem
unfortunately, it implies a central authority which knows all the keys (by construction)
the smart thing in IBE is that the central authority needs not be online: it is like a black box through which all emails go, except that the box is virtual and thus cannot block the system due to a hardware failure.
The central authority is still trusted in the intelligence agency sense: it has the power to betray everybody.
I have no problem in exchanging encrypted emails when I deem it important because of possible confidential issues. This implies exchanging some PGP keys when I meet the people.
The real bugger is about getting signed emails -- the kind I could use as proofs in a legal dispute. For that, we need a PKI.
That's my conclusion: the Internet at large, for all its business-like transactions, requires integrity more than confidentiality (it needs confidentiality mostly to protect the tokens which ensure integrity, e.g. passwords).
For usages which need confidentiality, the case for a global, worldwide identification system is much weaker.
@CodesInChaos One CA I did business with did not use the registry for that, but the K-bis (i.e. some paper-based documents, totally outside of the Internet)
Is there any way to measure scada systems security. any specific methodolgy ?
just wanna know is theres is any particular audit checklist to examine SCADA systems.
kindly post your answers. thanks
Blame Pekka for this answer, he put me up to it ;-) . Enough cats, Pekka?
Yes, we need something linkable. The FAQ is an ideal place for this, but there are lots of other similar things that can go there as well. We don't want to bloat the faq, too few people read it already. Still, this par...
As with most things - it isn't about the tool, it is how you use it.
Take nmap for example.
Beginners to the tool or script kiddies might run scan using the default option.
nmap 192.168.1.0/24
The default behavior for nmap without specifying any addition flags would be to perform a syn s...
Using Ubuntu 12.04. is there any way to hide a running process ? That process shouldn't' display in system monitor,top,htop . There is no problem to remember the process id (PID) so observation of the process can be done easily .but i want to hide the process completely . is there any way ?
