How much security expertise does a general application programmer need to develop software ethically?

Thats an interesting question. At first we as software developers create code (which means, applications) for a specific business purpose. So a good programmer should be able to dive into business domains and transform functional requirements into working code.

But software is complex and there are dozens of technical / non-functional requirements that a developer should be aware of, for example performance, stability, user interface, security and so on.

I think it's not possible to be an "expert" in every technical domain. But - and I think thats the point - if you or your company wants to build "professional" software, there should be at least one expert for every technical domain. Talking about security, there should be at least one security engineer who can do code reviews, internal penetration tests and so on. While doing such things in coorperation with the actual developer who wrote the code, there should be some kind of knowledge transfer between the expert and the "novice". That way, every developer should earn a basic knowledge over the time.

The challanges for the company are a) sensibilize every developer for these topics so that they don't "roll their eyes" when it comes to such things and b) establish a software development process / lifecyle where these topics are included.


Is message signing important in a client-server chatroom already over TLS?

Using TLS doesn't prove the user's identity.
When you use a web browser to connect to a chat room, the server doesn't authenticate your web browser. Only your web browser authenticates your server.
If you are using a chat client, it MIGHT use client side authentication. Even in that case it will just ensure that you are using a valid client. The certificates stored in clients are not the user's certificates. If a web chat room did create certificates for each user, then a user would have to be educated to install it's server on the client and also it will be a pain for multiple accounts to access the chat room using the same client (say a shared computer in the house).

To prove that it is actually you who is sending the messages, you should use message signing unless each chat client has a unique key and you have a mapping between the chat client and the user..


Antivirus for scanning anonymous file uploads

A lot depends on which unix like environments you're talking about. Linux probably has the best support for AV engines - but the open-source ones will run on any posix environment.

ClamAV
FRISK F-Prot
Kaspersky
OpenAntiVirus.org ScannerDaemon
MKS AntiVirus
Sophos Sweep
Symantec AntiVirus Engine
Trend Micro

Personally, I'd go for Clam Av. Not only has it got a very good fingerprint database, and update mechanism, but (perhaps not surprisingly) it's well documented as tool for integration into applications.


Check Base64 Data isn't malicious in PHP

If you run urldecode(base64_decode($input)), it will not be executed, just decoded. In your example if an input is eval(...), then you get the string eval(...) after decoding. Unless you explicitly run it, it will not execute.

By the way if the only point of applying base64 encoding is to increase security, as for any other encoding, it will not.


Do I need separate revocation certificates for each email address associated with a key?

A dedicated revocation certificate generated with --gen-revoke is created for the primary key and does not include any information on a given user ID, but when distributed will also indirectly revoke all user IDs and subkeys (as they're only valid together with the primary key).


The same way that Windows 10 does:

Add a setting to it that lets its owner/administrator enable "Developer Mode". This is secure as it gets unless your security model is something evil like "keep the device safe from its owner so I can do DRM".


Sniffing unencrypted traffic in datacenter

To perform a successful MITM attack you need one of two things (assuming encryption is not utilized).

Exist on the same network of the traffic you are trying to intercept
Exist on the path of information of the traffic you are trying to intercept

This means that if someone else has a droplet on the same subnet as you they can potentially eavesdrop on the communications that exist on that network. This monitoring could be done with the help of a network analyzer tool like Wireshark, or with a technique called ARP Poisoning if the conditions are correct.

I don't have any intimate insider knowledge of how the DO droplet isolation or network configuration works, but anytime you transmit sensitive data between any machine (even when both machines exist on the same trusted network) you should be leveraging TLS to mitigate traffic interception.


How useful is it to prevent Linux applications from setting up any untrusted connections, and can it be done easily?

You bring up a good point. EDR (Endpoint Detection and Response) has been created for this very reason. Vendors such as Crowdstrike do a great job at protecting endpoints. To my knowledge, most EDR software is developed to be invisible to the end user. Mostly because hosts are centrally managed by a administrator. A decent EDR would detect when a user downloads and runs a new application and you can track everything the program does, such as making outbound connections.

This type of software has to be very robust and smart so it is usually expensive. I would guess that is the most likely reason why it isn’t pre-installed on most Operating systems.  EDR is available for most operating systems, Linux included.

To answer your question directly, it is very useful to monitor network connections from I trusted apps and it is usually difficult to do so effectively.


Problems with intermediate SSL certificates and SSL proxy

The browser can use only the certificate that it knows of. In the case of SSL server certificates, there are three methods by which the browser will obtain the certificates needed to build a chain from a root that the browser trusts, down to the certificate to validate (in your case, the "fake"):

The browser may have a local copy of the certificates (in a store named "intermediate CA" or something like that).
The browser may follow the URL found in certificates themselves. A certificate may have an Authority Information Access extension, which may point (with a URL) to a place where may be found the certificate for the issuer of the certificate which contains the extension.
A SSL server is supposed to send its certificate as part of a fully grown chain.

The automatic download works only as long as the URL are present in the certificates, and the corresponding servers are reachable; moreover, to prevent nasty chicken-and-egg issues, the said URL shall be HTTP, not HTTPS. Not all browsers will do this download, though. It depends on the browser and also on the operating system, and their configuration. Some browsers will refuse to use anything else than the exact chain sent by the server.

So my guess is that your proxy, which acts as a SSL server, does not send a complete chain. It sends the "fake" certificate, and the "proxy intermediate CA", but not the "company intermediate CA". Thus, the browser lacks this last certificate and cannot build a complete chain.

To verify this, use OpenSSL (the command-line tool):

openssl s_client -connect www.aservername.com:443

This will print (among other information) the subject and issuer names for all certificates in the chain as sent by the server.

Alternatively, run some network monitor tool (e.g. Wireshark) to see the SSL Certificate message from the server, which contains the certificate chain from the server.


How to Get and Set Digital Signatures with FDA 21 CFR Part 11 Standards

Reading the regulations themselves is a big start there. I'd also look at the most recent guidance that I've found. As I quickly interpret it, these aren't digital signatures in the way that most of us are familiar with. Rather, they are fields on data set by a controlled process which requires authentication, creates audit logs, and is under appropriate controls.

I'd implement something like that with a table that links signatures to document ids and records all entries with sequential numbering.

Beyond that, you're probably into needing to pay for consulting work.


Thats the shell code generated in python, you execute that on the target/vulnerable machine in general. Thats are the opcodes in assembler and python dont know nothing about it in general.

What you can do is to convert your shell code in assembler with any disassembler(capstone, distorm, etc...) python lib and then check this link https://stackoverflow.com/questions/6040932/executing-assembler-code-with-python. But you question is more about programming than security.


Is there any information I shouldn't include in questions about GnuPG aside from my private key?

Publising Information on Your Key

Hiding your private key is obvious, and you already noted that.

The only further thing not to publish (without intent to do so) is the revocation certificate you might have pregenerated (and GnuPG 2.1 is doing so by default for a good reason). With such a revocation certificate, others could revoke your key by uploading it to the key servers. Sharing with a trusted friend or family member on the other hand might be a good thing to do: they could still revoke your key in case anything happens to you (consider it a kind of digital last will).

Other things are hardly a problem. If you publish your public key (or fingerprint, mail address, user ID: all of those could be used to retrieve your key from a key server, given it is uploaded; and if you use your key, expect it to get uploaded by anybody by mistake or intent). This might allow to connect your Stack Exchange account with your real identity (which on the other hand does not seem to be a problem to you, looking at your profile).

From all further information like key IDs, fingerprints, user IDs, ... neither your private key nor revocation certificate can be calculated. Key IDs are the lower parts of the fingerprint, which again is calculated from the creation time of your key and public key.

Publishing Information Created Using Your Key

If you do not want to reveal your identity, be aware when publishing encrypted and/or signed data for/from your key, even if your strip parts of the ASCII-armored or binary output; or publish parts from your public key. It includes the whole key fingerprint, and does so in the very first parts. If you have something like

-----BEGIN PGP MESSAGE-----
Version: GnuPG v1

owEBOgLF/ZANAwACAY545E37G1XpAcsKYgBV6J49Zm9vCokCHAQAAQIABgUCVeie
PQAKCRCOeORN+xtV6fZxD/oCEDFuXBwdF07UDZOh0v2x7CX7UmruCRs2MwcmZoHV
Uiiag9ibc3951pxCdNfDdB6rKKYc4fqqkMOTFqdi9DXBs6u7r8oiuuDTpqSJxyaM
lgUTiE/8oiF2/JtLgrFTVr5Kq7tgSs5WJ++zW0bPBNQHZoQ58fQsuAc0cn408m1j
[snipped some lines for assumed privacy]
iJiQoufmmGZdXFhFKW3hVxabEvfCxHqfvdMDhYh257r69AXTwsLsvXTJ6XXms9xy
LQ==
=pNoP
-----END PGP MESSAGE-----

an attacker will still be able to parse the packets manually (although neither gpg --list-packets nor pgpdump will help at analyzing such broken information without modifying their code), and you need some understanding of RFC 4880 (and a hex editor).


What security products are necessary or advised for a home computer running Windows?

Malware is a catch-all term for all viruses, trojans, worms, etc. Very few threats fall into a single category anymore, most malware has traits of all three, so defending against one type of threat is of little use. Anything that calls itself an antivirus is really anti-malware, it's just product naming using familiar terms.

All that you really need as a home user on a home computer is one antivirus/antimalware program with a built-in software firewall. Most of the good ones will also have additional features like browser plug-ins and email scanners built in as well. That gives you a simple, one stop shop for home computing security.

As important as having a good security software package is to keep your computer as up to date as possible with security patches and updates. Also having a firewall instead of a modem on your broadband line.


You should get a professional to perform the test.

I however get the feeling that this not an option for you - so communicate to the person who hired you what you can do:

You can use Static Analysis tools - There is a whole list of Open Source and Commercial tools available on the OWASP Secure Code analysis page.
You can use Dynamic Analysis tools (or Vulnerability scanners) - See a list of Open Source / Free and commercial tools available on the OWASP Vulnerability Scanning Tools page.
(You / they can hire a Penetration Testing company to perform a penetration test).

It should be noted that running Static and Dynamic analysis is not the same a professional penetration test, but it should catch some of the low hanging fruit.

To answer the question of the location/environment of the Penetration Test - I advise that you do a Penetration test in an environment which mirrors your production environment - especially if you already have clients using your application.


It depends for what you need to use hash-based signatures, but if we look in clamav signatures there are some options:

Hash-based signatures

To create MD5 signature you can use sigtool:

sigtool --md5 test.exe > test.hdb

You can also go with SHA1 and SHA256 signatures:

HashString:FileSize:MalwareName

Another options is Hash signatures with unknown size:

HashString:*:MalwareName:73

  Is there an alternative to using hashing to identify malware?

And then you have body-based signatures.

  ClamAV stores all body-based signatures in a hexadecimal format. In
  this section by a hex-signature we mean a fragment of malware’s body
  converted into a hexadecimal string which can be additionally extended
  using various wildcards.

Simple rule format can be used in this way:

MalwareName=HexSignature

You can also check YARA tool for creating body-based signatures.


OAuth2: Where should I store my refresh token in a stateless application?

Put is simply the answer is "Don't use the refresh token" because it's not how the system is supposed to work when you're having SPA, apis and an identity provider. The documentation is a little bit confusing on this point because it has been designed a long time ago, before SPA were dominant. The main issue is that, at first, you probably considered the api servers as the relying parties and the angular application as just "front". At least it was the problem that I had. And it's simply not the case.

The key point here are that:

Your SPA is the relying party, not the flask APIs server.
Your APIs only need to validate the JWT token, not to take part in the authentication flow or get access to refresh tokens etc.
Your SPA doesn't need to obtain/use refresh token as those are mainly use by more "controlled" type of services. Instead openid connect includes an iframe logic in its specs, allowing the RP to get new access and id tokens when the current access token is close to the validation end date time.

The next question is which authorisation grant flow you should use ? The answer is PKCE. You don't want to use implicit because there are known security breaches. You can't use classical code flow because you'll need to put the client secret in the angular app. Luckily that's exactly why PKCE has been created: https://tools.ietf.org/html/rfc7636

And to implement that you'll need 2 things:

Implement the PKCE logic in angular, but somebody already did most of the work: https://manfredsteyer.github.io/angular-oauth2-oidc/docs/additional-documentation/code-flow-+-pcke.html
A python lib that simply check the received token to authenticate the user at the api level. I don't know flask very well but for Django I use a small lib: https://github.com/ByteInternet/drf-oidc-auth. That lib is basically one file. You want stateless so you want to use a JWT instead of a Bearer.

Once you're there, the system will probably suit your needs:

Long run authentication is handled by the IP, and as long as the user is logged in at the ip level, the iframe will ensure that his access/id tokens are up-to-date.
API servers are stateless and don't require a database.


This company is telling me that I need a firewall. Do I?

You needn't buy anything from someone who calls you unsolicited and tells you need to buy something from them.  In fact, you're generally better off not buying things from people who call you unsolicited.  In fact, you're generally better off not even listening to people who call you unsolicited to sell you things, and just hang up on them instead.  Particularly when they lie to you about things like "alerts keep coming up on your network" which is patently absurd.

The Microsoft firewall does not expire. Not on 8/16/16, or on any other date. It is a component of Windows and is good for all eternity, or as long as your computer lasts, whichever comes first.  There is no need to buy an additional host-based (runs on your computer, in other words) firewall.


Automatically ensure that a site's certificate (authority) has not changed

Can I configure my browser (Chrome, Firefox) to throw an alert if the certificate issuer / fingerprint changes ?

Chrome and Firefox both support HPKP which allows you to pin the public key of the certificate for a specific host. this does not throw an alarm if the issuer changes but only if the public key of the certificate changes. This is an even more strict protection because anybody who would like to impersonate your site would need to have your original public/private key pair, no matter which CA is used at the end.

  In short, how can I untrust trusted authorities on a per-domain basis ?

There is no way to say up-front which CA you will accept for which site. But once there is a certificate for a site you can use HPKP to accept only certificates with specific public keys for a site.


Select a TripleDES key so that it effectively behaves as regular DES

DES is defined to use a 64-bit key. Only 56 of these bits are really used, so the "effective key length" (for resistance against exhaustive search) is that of a 56-bit key. Yet, any implementation will expect a sequence of 64 bits (hence, 8 bytes, not 7).

Triple-DES (aka "3DES") is three DES instances in due sequence. The "middle" DES instance is used in decryption mode, precisely so that an engine which implements 3DES can also execute plain DES. If you name the three successive keys K1, K2 and K3, then, when K1 = K2, the two first DES instances cancel each other (the second DES being in decryption mode, it reverses what the first DES did), so this is equivalent to simple DES with key K3. Similarly, if K2 = K3, this is equivalent to simple DES with key K1.

3DES nominally uses a 192-bit key (three 64-bit DES keys), out of which 168 bits are really used. Yet, there is an "academic" attack against 3DES with cost 2112, so it is often said that the overall security of 3DES is similar to that offered by a theoretically perfect block cipher with a 112-bit key. Hence, there is a widespread usage mode of 3DES in which we use a 128-bit key: 64 bits for K1 and 64 bits for K2, and then set K3 = K1. In plain words, encrypt the block with K1, then decrypt with K2, then encrypt again with K1. This seems sufficient to achieve the 112-bit level of security (of the 128 key bits, only 112 are really used), and the academic attack shows that you cannot go beyond that level anyway (112 bits are already quite far beyond what is technologically breakable right now, so no worry)(Edit: D.W. points out that there is a better attack, provided that you can harvest quite a few plaintext/ciphertext pairs; still, the attack cost is still too high to be used in practice). This is what your smartcard implements.

Note that there are protocols which use 3DES and really require the full 192-bit key, and cannot work with an implementation which only supports 128-bit keys; a prime example is SSL.


Is Android Gmail app susceptible to MITM, sslstrip? If yes, how?

SSL-strip is not an issue when you are using an app, it is only an issue when you are browsing the web through a browser. It works by replacing HTTPS links with HTTP links in an HTTP page. Since the URLs are usually hardcoded into an app, they can not be replaced by a MITM. So there is not the same need to worry about SSL-strip. (I guees you could get in trouble if the app follows URL:s in an API response, but I am pretty sure Google is smart enough to make sure they are to the right domain and use the right protocol.)

I have not been able to find an official statement, but I am pretty sure that the Gmail app uses TLS. Their webmail is only served over HTTPS, and other clients connecting to Gmail must use TLS. I find it hard to believe that they would make an exception for the Android app. So I would not worry about a MITM even if you're using public Wi-Fi.

Besides, I am not sure the app even uses the password - probably it uses some other kind of access token.

So how was your password stolen? I have no idea. Maybe you reused it on some other site? Maybe you entered it somewhere else? All I'm saying is that it was probably not sniffed from the Android app. Anyway, if you haven't already done it, you should change it.


IIS renew option missing for self-signed certificate

Such a button does not make sense. Renewing a certificate typically means generating a new certificate request (and possibly automatically sending it to a CA). A self-signed certificate does not have a CA to sign it so there is no point in generating a certificate request: just generate a new self-signed certificate with the same name.


Interesting question. I've worked in secure file transfer software and I am currently in log collection.

Are you carrying out managed file transfers? For example, you have a secure file transfer configuration rules set to automate certain tasks. Or do you mean that you have a Win 10 machine set up with a GUI file transfer software that is being used by a user?

Also this is on the FTP protocol, right? Not like FTPES/FTPIS? Is the network accessible as something like a VPN for local network? AFAIK, some users still use FTP but under certain circumstances, and any other circumstance we'd recommend they use FTPS.

--

  I could make it very useful to detect malware, unauthorised admin privilege usage, unauthorised network usage, and etc?

To start, here's a few to look into:

Windows EventLog collection. To start, check out Malware Archaelogy's talk Security Compliance - Finding Advanced Attacks PDF via search which lists out EventIDs to log and monitor.

Windows Registry Monitoring. To monitor changes in the registry made by Windows or a certain program.

Windows DNS Monitoring ie monitor any calls to CnC servers.

If you have any important files (like the file transfer configuration file) you may want to implement file integrity monitoring to monitor for any changes to this file.

Then you would want to collect these logs with something like NXLog (disclaimer, I am involved in that project) and send these out to a centralized log server on the event that the FTP client is unavailable or goes down.


There are several improvements that can be made to the functions you've given, based on my knowledge.

Obvious threats

First, and most important, keep your private key secure, and make it external to the function definition (e.g., a second argument). I would recommend spending significant effort solving this problem. Is this per-user encryption, or application-wide encryption? If it's per-user, then why not use a key derivation algorithm, such as PBKDF2? If it's application-wide, then good luck with secure storage - I've thought about it before, and it seems non-trivial for a typical web app. Just make sure that you don't store the private key along with the source, nor (obviously) in the same database.

Also, as an aside: never use symmetric encryption for anything that's password-like. Use a one-way hash instead. I'm assuming, for this answer, that you need to actually recover the original CD key, rather than just verify a match.

Second, I'm dubious of the use of MCRYPT_RAND. It sounds like it might be the same PRNG as rand(), which is not ideal. Generating the IV with MCRYPT_DEV_URANDOM is what I'd recommend - /dev/random and /dev/urandom are both considered top-notch sources of cryptographic random numbers on Unix-based systems. Note that you don't generally want to use /dev/random for a web application, because it would open up an easy DoS vector - and /dev/urandom should suffice outside of embedded environments, anyway.

Other implementation issues

Now, with the major vulnerabilities that I can spot taken care of, a few more fine-grained details:

You're mixing OpenSSL and mcrypt functions. Also, openssl_encrypt is not documented in the official PHP docs (I suspect it's documented for C somewhere, though...). It might be better to use mcrypt_encrypt instead, since it's explicitly documented for PHP.

You're mixing CAST-256 and AES-256, as well. You should probably stick with AES-256 throughout, since that's the generally-advised standard algorithm for strong symmetric encryption. Note that AES-256 is MCRYPT_RIJNDAEL_128 used with a 256-bit key, and is NOT the same as Rijndael-256, which is something that I hadn't previously realized (the more you know!).

I'm not sure about the preferred cipher mode, but CBC is one that I have seen recommended for AES, at least. Hopefully someone else will have some input.


Password and username used to connect to database in source code

The next paragraph is key:

  Such constants belong in properly protected properties or configuration files.

You should define the username/password credentials as variables in a separate file, something like db_config.php. This config file should then be included by whatever PHP source code files need to use them for connecting to the DB.

This config file should have permissions set so that the general public cannot read them, and should be excluded from source code version control so they do not get checked in.

The basic goal is for the sensitive information to be contained in just one place that is not a part of the main source code.

This does not mean that the credentials won't be in a file alongside the source code, and it does not mean that the config file cannot be a PHP file.


Does routers, firewalls log dedicated server connections?

It is certainly possible and should indeed be done.

However, your question is very broad indeed as there are many uses for data centres ranging from ones that cater for a single customer through to global cloud data centres. You need to be more specific.

One of the major issues with logging in DCs is obviously the amount of traffic generated and this can be a real headache. Busy DC's will generate MB of data per hour or more which has, somehow to be handled.

So while it is possible, it isn't necessarily easy and some DC's will limit the traffic in certain logs.

There is also the issue of what to do with the data. Having it is one thing, using it is totally another. You absolutely have to have systems that summarise and chart the data so that humans can spot issues and react to them in a reasonable time.

You may note that, depending on what the DC is used for and also what country it is in, there may also be legal requirements for logging.


How os fingerprinting works and how to prevent it in browser?

Probably you need to combine two methods:

At application level, for example HTTP, by changing the User-Agent and probably other fields.
At network level, changing IP TTL, TCP window sizes, and so on

Probably with that should be enough but may be I'm missing some of them


add another layer of protection on top of oauth 2

As soon as you deploy your client to a device you cannot fully control, there is no way to be absolutely sure anyone can tamper with the requests.

What you can do though is put some measures in place that will require work from the attacker, for example, you could encrypt and/or sign your data using embedded keys in the application. In order to send data to the server, the attacker would have to perform the task of encryption/signature to send you valid data. This means he would have to reverse engineer the application or find a way to use your app to do the work for him (which should not happen). Someone motivated enough will eventually succeed since all the data are present on his device. The idea is to be time consuming so that he will find it not worth the effort.

OAuth only solves the problem of authorising a specific user. So you should be able to ensure that a user can only tamper with it's own requests and not the requests of others.


Create a snort rule that will alert on traffic on ports 443 & 447

I had to solve this exact case for Immersive Labs! This is the rule you are looking for:

alert tcp any any -> any [443,447] ( msg:"Sample alert"; sid:1000001; rev:1; )

Also, I noticed your sid:1. All sid up to 1,000,000 are reserved. So your sid must be at least 1000001.

Note: there must not be any spaces in between each port in the list.


It's difficult to tell the exact reason why, especially if it is a black-box test and you don't have access to the source code. Session generation and management should normally be handled on server-side, so the repetition in Mac, top of my mind, could mean one of two things.

It could be pure coincidence
The session id generation has dependency on client-side

The second could mean a flaw in generation of session id. You could do a thorough check on the scripts in the client-side to see if the client could indeed influence the session id.

For pentesting session ids, may I suggest to just do an entropy test. Recommended entropy is at least 128-bits. Judging from your script, you can easily send the http request to burp sequencer, and run an entropy test with 20,000 as sample size.


Checking a locally stored string for tamper

What you want is something that ensures integrity of your data.

The most common solution for this is to use an HMAC, that is a keyed digest. NodeJS has an API that calculates HMACs. Compared to a "salted" hash, where you would keep the salt private, HMACs are designed to be secure even against some additional attacks, such as length extension attacks.

As long as you keep the key private (and large enough), you should be able to use the same key for all users.

Be aware that this won't prevent people from sending you a previous version of the data. All this does is guarantee that the data was valid at some point. If you want to be sure they're sending you the latest version, you would need some server side storage to store either a version number, a timestamp or the last data digest. If you choose to store the last digest, a normal hash will suffice, you won't need to send the hash or a HMAC to the client.


What could be the reason for weird amount of signups from mail.ru domain?

mail.ru probably has an easy sign-up option which means that hacking networks can sign up thousands of accounts per day. This offsets any attempt to get the accounts banned or blacklisted.

The reason is likely to be attempts to find entry to legitimate security sites so that they can piggy back to more interesting targets.

Since it is really unlikely that you will have a legitimate customer using mail.ru, I'd probably just block access to that domain.

It seems there has recently been some very large increases in this kind of activity along with targeted attacks and Wordpress attacks, possibly some new networks appearing.

The signup form on the labs page doesn't seem to do anything but if you are seeing some activity on it, it will be because you haven't added any bot protection to it maybe.

Ah, just found the second form for a subscription. This also appears to have no protection on it. I entered a random and fairly obviously incorrect email address - even with an invalid top-level domain - and it accepted it.

As an aside, that page fails accessibility standards really badly (the colours on the subscribe form are almost unusable to me let alone to anyone partially sigted or with colour-blindness) so you might want to think about that as in many countries, you will get into trouble if someone chooses to follow up on it.


Standards for encrypting passwords in configuration files?

If you are running a server that needs a password for access to some remote service, then there's no good solution.  Storing the password in a configuration file stored in a suitable location is probably making the best of a set of poor choices.

The choices are: have a user enter in the password at boot time (this is bad, because if your server gets rebooted, now the server is unreachable until a person can physically walk up to the server and enter the password); hardcode the password into the source code of the server code (this is much worse than putting it in a configuration file); or store the password in a configuration file (the least bad of all options).  The main thing to watch out for with the configuration file, is to make sure it is stored outside of your web root and that its file permissions are locked down appropriately.

Encrypting the password that's stored in the configuration file doesn't help, because now where do you store the decryption key?  You've just shifted the problem around.  "It's turtles all the way down" is not an acceptable response.

On Windows, another option you might look at is storing the password in DPAPI.  This helps a little bit for desktop applications, but is not very useful for unattended servers.

For more, read the following questions on this site:
Store a password to avoid user interaction,
where to store a key for encryption,
How do open source projects handle secure artifacts?,
How can I decrypt data with Java, without hard-coding the key?,
Password in file .php,
Where do I securely store the key for a system where the source is visible?.

P.S. In principle, you could use a TPM to store the password -- but in practice, this gets you into bleeding-edge issues, so it's probably not viable for most folks.


Is using VPN, Tor and ProxyChains together more secure?

In theory yes, In practice maybe not but also yes at the same time.

If you were to use VPN and a tor network you remove one of the security layers in the tor network. tor uses relays and your path changes every time you use tor by using a VPN you would be using the same end point (assuming you went TOR -> VPN)

If you went VPN -> TOR, You would encrypt all of your traffic to your start point (The VPN Out interface) and then the TOR network would take over, the issue here comes with the VPN service its self, they could very easily see you are using the TOR network, this would be your weak spot you want to be under the radar with everything.

To make it secure you would need to buy an anonymous VPN and pay for it in bitcoins after rolling your bitcoins via a tumbler (depending how you obtain the bit coins will determine your weak spot in the chain, but the tumbler should fix most of that issue). To also secure the purchase make bitcoin transactions and VPN transaction VIA TOR.

then once you have the anonymous VPN you would not want to connect to your VPN from your home address (though anonymous VPNS hold no data so technically you shouldn't be able to be traced from your home address). then once connected to the VPN you can use the TOR network that way.

Personally I wouldn't use proxy chains it would become pointless seeing as you are using TOR also proxy chains leave behind clues on your machine (they like to leave behind messages about how they connected to the proxy chains). also it really makes the process slow for very little benefit.

To summarise:

Using a VPN creates an issue with its self as to obtain the VPN you would use personal information. though any extra security would be nice as you mentioned the chain is only as strong as its weakest link. The VPN would be the weakest link with personal information following you back (using a free VPN would end up in records being kept of your activities).

Keeping data private is not the issue here, its keeping the data disassociated from the owner. 01/01/1970 is someones birthdate, asking someones birthday can be a security question...sadly I dont know who this birthday belongs to, following?

Hopefully I kept mainly to the point in my answer.


With the infrastructure you're going to have sitting around your house, and your lack of advanced networking knowledge, you're not going to be able to sniff packets on your desktop using a laptop.

While your desktop is connected to your home router, traffic between your desktop and router will not be replicated over other router ports or over wifi. Traffic from your desktop gets routed exactly to where it needs to go.

While your desktop is connected to a home switch, the same logic applies--
 traffic between your desktop and switch will not be replicated over other ports either (unless you ARP flood it and your switch is susceptible to this attack).

What you're trying to do would have been possible 20 years ago if you connected a consumer hub between your desktop and router, since traffic on those got blasted to every port, but hubs don't support modern network speeds so they've fallen by the wayside. The modern replacement is a network tap but you can't just buy one of those at your local Best Buy ($$$)

Given your environment you'd be best off generating pcap files on the source box and shuttling those elsewhere for analysis. Use daemonlogger instead of Wireshark for this sort of task; Wireshark is way too bloated and doesn't handle file rotation.


When hashing passwords, is it okay to store the algorithm used right there in the database?

Sure it's ok. This is a simple application of Kerckhoffs's principle: the secrecy is not in the algorithm, but in the key or password. For starters, anyone who has access to your implementation, or to its documentation, or who knows what is supported by the libraries your application is built with, knows what algorithm(s) your application may be using. At most, the attacker would have to try a small list. And if there are several possibilities, your application would also have to try that list, making authentication slower for no good reason (you increase your own workload by the same amount as the attacker's).

As you've noticed, it's common practice to prepend the identification of the algorithm to the salt and hash. Granted, common practice isn't always sensible, but here it is. Bcrypt uses numerical codes inherited from Unix practice. You can use your own naming scheme if you prefer, though as usual you should stick to what your library provides unless you have a very good reason to do your own thing.


Why does OpenSSL show different CAs for mail.google.com:443 than what Chrome/Firefox shows?

Chrome is not using HTTPS as you are doing with openssl s_client but it uses the QUIC protocol to access the site. In the Security Overview (developer tools) you can see:

  The connection to this site is encrypted and authenticated using a strong protocol (QUIC), a strong key exchange (X25519), and a strong cipher (AES_128_GCM).

This means it accesses a different service which provides a different certificate. For why they offer a different certificate there you have to ask Google.

Once you disable QUIC in chrome://flags and relaunch the browser you get the same certificate as openssl, i.e. the one for mail.google.com. And the Security Overview now shows:

  The connection to this site is encrypted and authenticated using a strong protocol (TLS 1.2), a strong key exchange (ECDHE_ECDSA with X25519), and a strong cipher (AES_128_GCM).


First, a word on security: Security does not exist in a vacuum; it is completely dependent on the circumstance.

Defending against an unrealized threat is wasteful. Not defending against a trivial attack renders your system useless. As such, blindly adding security measures is an exercise in futility. One must have a well-defined set of goals for a system, also known as a threat model.

If you intend on achieving "online privacy," you should define your own threat model. Some questions to ask yourself:

Who is your adversary? (Are you defending against script kiddies? The NSA?)
What behavior do you intend on keeping confidential?

What about the system you would use to address this model?

What compromises are you willing to make to keep your behavior confidential?
What are the constraints on your solution? (e.g. time, budget, hardware, etc.)

Now that you have defined the boundaries of your problem and those of your solution, you need to determine what portion of this you can fulfill and at what cost. Here is where your question comes in:

  Is using Tails any less secure than carefully building my own privacy-focused stack...?

This is ultimately about the tradeoff between threat coverage and cost (your development time). Essentially: What security do you gain from cobbling together a secure live OS that you wouldn't have with a product like Tails (and vice versa)? Your proposition is that a system you design will either 1. Have fewer bugs/exploits and/or 2. Have fewer known bugs/exploits.

First, it is entirely possible (albeit unlikely) that, at any one point in time, a system you have built with publicly available "blocks" will have fewer bugs than an open-source system already in use. The benefit of FOSS is that many eyes on the code means a higher likelihood that a bug will get discovered AND will get patched. Code that you write will inevitably have bugs which you will be much less likely to catch unless you spend your days reviewing source (even then there may be some issues even you cannot spot).

Addressing the issue of known bugs, "rolling your own" system is essentially security through obscurity (or, perhaps more accurately, security through minority), that is, relying on an attacker's unfamiliarity with a system to ensure its security. In general, this does not represent a marked increase in security, certainly not if you use FOSS building blocks.

The Tails project itself is actually quite similar to the "combo of software" you describe. Quoting directly from Tails' Contribute page:

  ...We try not to reinvent the wheel, and we flee the Not invented here syndrome like the plague. Very little code is actually written specifically for Tails...We glue existing pieces together.

This underscores the inherent tradeoff in developing a security system: Each line of code and each new design decision increases the likelihood of a bug being introduced.

While it may be tempting to read about these 0day revelations and say "I could do this better," it is important to realize the benefits that accompany widely available, open-source tools. If you aren't willing to put in the time and effort required to develop and maintain an entire secure OS (a daunting task for a large team let alone a single developer), then you might consider adding another set of eyes (read: yours) to an existing project. But that's just my 2¢.


Spoofed number sending threats to students. Can it be traced to sender?

From what we understand, someone used the services provided by Google or another host to create an anonymous threat message and signed it with your son's name. Hosts such as Google usually have logs that indicate who they lent out the "temporary service" to at any given time. They would have the IP address or some other form of identifiable information associated with the entity who sent the message. It is highly unlikely that they are not maintaining any logs at all. Logs are maintained for cases such as this where improper use of services is observed.

The real question is -- can you obtain this information from the host. The short answer is -- not really. Hosts such as Google are reluctant to share such details with just anyone due to privacy concerns. Your best bet is if the law enforcement involved requests these details from the host. They are more likely to comply with the request if law enforcement demands it for a valid reason. Unfortunately, there is not much you can do as an individual. Anonymity is the nature of many Internet services.


prevent/prohibit duplication of MFA software-token / ensure user identity

You cannot solve this with technology. It's a policy problem, not a tech one.
Even if you use a hardware token, nothing stops them to call the colleague and get a token. If you have a biometric-backed generator, or whatever, they will find a way to share. Having Human Resources step in and having a strong stance on this matter will solve it.
Remind everyone that sharing OTP tokens are a fire-able offense, and if (when) someone breaks this rule, fire him and summon a company-wide meeting after that to tell everyone that Mr OTP-Sharer was caught sharing his token and was fired.


Finance with the multitude of "Secure Browsers"

The challenge with any non-mainstream browser is that writing a browser engine from scratch is a complex and expensive process, and maintaining a fork of a browser and tracking upstream is also a complex process, especially once the fork starts to deviate significantly from the base project.

If you look at the problems that WhiteHat aviator encountered earlier this year and the fact that it's no longer maintained by WhiteHat, you can see an example of the possible issues.

Not to say that I think it's impossible for someone to do a good job of creating a browser more focused on security, but that it may be hard for the company doing it to dedicate more resource to security than the mainstream browser developers already do (from that google plus post, the chrome team have 30 full-time security people).

Personally I'd recommend using an up to date platform with decent security tools and, if you're specifically concerned, consider having a device or VM dedicated to financial transactions, to separate it out from other browsing.


Secure Development Environment for University dealing with private data

Take a look at the PCI standard, it has a lot of guidelines on how to secure credit card data that can also be applied to any confidential data:

https://www.pcisecuritystandards.org/

Not everything will apply to your environment, but it's a good starting point. It covers things like encryption of the data, key management, keeping audit trails, anonymizing data for test/dev machines, securing workstations that have access to the data, etc.

Build and Maintain a Secure Network

Install and maintain a firewall configuration to protect cardholder data
Do not use vendor-supplied defaults for system passwords and other security parameters

Protect Cardholder Data

Protect stored cardholder data
Encrypt transmission of cardholder data across open, public networks

Maintain a Vulnerability Management Program

Use and regularly update anti-virus software on all systems commonly affected by malware
Develop and maintain secure systems and applications

Implement Strong Access Control Measures

Restrict access to cardholder data by business need-to-know
Assign a unique ID to each person with computer access
Restrict physical access to cardholder data

Regularly Monitor and Test Networks \

Track and monitor all access to network resources and cardholder data
Regularly test security systems and processes

Maintain an Information Security Policy

Maintain a policy that addresses information security

(those steps are supposed to be numbered sequentially to match the PCI DSS steps, but StackExchange is smarter than I am and ignored the numbers I typed and started at "1" for each heading)


Security Modules - Hardware vs. Software

Something like a Gazzang zTrustee could be used to meet the PCI key management requirements. The trick would be to make sure that they help you follow all the requirements for PCI compliance. A good way to do this is to see if they are FIPS 140-2 certified, or at least follow the FIPS 140-2 standard published by NIST. A short review of the their site I don't think they are certified by they do mention that they follow FIPS requirements. It would take some more digging and asking questions to see what they actually mean by that.

As a more general answer to your question, PCI doesn't dictate that you have to use a hardware device for key management. You can use a either or a combination, anything that helps you meet the outlined requirements in section 3 of the PCI DSS.


With DNSSEC, is there any benefit in DANE for a CA- issued Cert?

Well, DANE can, in conjunction with Public Key Pinning' (HPKP),  protect your current users from malicious use (even if the DANE record changed, the browsers will still remember the HPKP headers and fail to connect). This does not protect new connections. But since HPKP has a life of at least 1 month it adds reasonably safety to your 'stack'.


What's the point in "authentifying an application" with its domain name against a db?

I think what the boss is trying to say by

  so that nobody would be able to use our code to fake our application
  through a similar domain as our

is that they don't want anybody else to make a different client for their application. They have a database of trusted clients for their webservers and they would honor requests made only from those addresses.
This idea of white-listing clients is an old one but their implementation is definitely flawed. Anybody can spoof the HTTP_POST parameters that they are looking for and make whatever SOAP calls they want.
This discussion (though not completely the same as what your boss wants), can help you out: Best practices for securing open APIs from quota theft


Fake email sent through newsletter service: how to know who sent them?

Bottom line - forget about it and move on

Email is inherently insecure. It is a trivial task to fake mail headers, there are far too many insecure and misconfigured mail servers which will accept/dispatch/relay messages from anywhere and there are numerous services available to send 'anonymous' messages. While mail headers may provide some information, you have to treat the information as suspect and only use it as a possible indicator.

The situation is further complicated by the fact that this is a global issue. While many countries have legislation which prohibits sending of unsolicited email and/or prohibits using false information, such as sender details, the ability of law enforcement to do anything about it is limited. We have about 50,000 users where I work and over 70-80% of the email traffic delivered to our sight is identified as spam (that is a conservative estimate). Even if law enforcement was able to do something about this, just the huge volume is enough that they will only be able to investigate a very small percentage. I suspect if you did report your case, the authority concerned would possibly take down your details and then file it in the round filing cabinet under their desk.

There is also the added complication of viruses and malware. There have been numerous examples of these using local adress books to send emails under the credentials of the system owner without them even being aware it is going on. This makes it even more difficult to prove a message has been sent deliberately and with intent. Even if it wasn't done by a virus or malware, the user could easily say, "yes, sorry about that, I accidentally hit the wrong button". Unless you can show repeated and deliberate malicious behaviour, there is little that can be done.

There are ways to make email more secure. Unfortunately, few if any, are transparent to the recipient. For example, you could use certificates and/or PGP signatures etc, but unless the recipients client is able to handle such techniques, there is little point. This also won't stop someone with malicious intent who is a legitimate recipient of your message from doing something like re-distributing your invite to others.

Tim


Why don't major browsers currently support TLS above version 1.0?

The main reason why there is little movement is that the "breaks" are not practical enough to show up on radar.

BEAST does not work anymore. Firstly, it requires a way for client code in the browser (hostile Java or hostile Javascript) to emit cross-domain requests with a high level of control at the bit level; the two known ways to do that (a draft version of WebSockets, and a vulnerability in the Java VM implementation) have been fixed. Secondly, browsers and OS have added workarounds, namely the 1/n-1 split: whenever a TLS record is to be emitted, two records are sent, the first one containing only one byte of application data. This workaround prevents BEAST from being applied.
RC4 breakage is still "academic". It had been known for some time that RC4 had some serious biases. The recent results (March 2013) are some systematic measures which show that there are more biases than previously thought, so that an actual attack requires "only" observing a few millions of connections with the target secret always in the same place. While "a few millions" is rather low, it is still impractical, from the attacker's point of view, in a Web context. Thus, no cookie has been stolen in the wild through usage of RC4. Moreover, there are possible workarounds which are easier to implement in a browser.

Thus, there is no real incentive for a mass update of client TLS implementations. Indeed, browser vendors are accustomed to deal, on a weekly basis, with vulnerabilities which are much more devastating than that (typically entailing hostile hijack of the whole client system). A somewhat theoretical exploit of the cryptography in SSL is unlikely to be even noticed, let alone acted upon. What makes browser vendors move towards newer versions is the publicity which is made about these cryptographic attacks.

Moreover, and that's the important point, the protocol version which will be used for any given connection is constrained by what both client and server software support. Upgrading client support to TLS 1.2 will not change anything at all until most servers are upgraded, too. And, similarly, upgrading server support is not very useful until clients are upgraded. This is the classic Mexican stand-off, in which nobody moves, because it would require a massive simultaneous upgrade switch of several distinct vendors. For that matter, it is the same story as with IPv6 (which was scheduled for wide adoption in 2007).

In practice, several widely used browser rely on the SSL/TLS code of the underlying OS, so any mass upgrade will have to wait for the end-of-life of Windows XP (scheduled by Microsoft for next year).


Split RSA private key into two parts securely

I'd like to split the private part into two pieces, D1 and D2, and store them in two different places. Is it secure if I just choose D1 as a random string (same length as D) and D2 is calculated as D XOR D1?

Yes. This is known as the one-time pad, and it is the recommended approach. The only way to get the original secret will be to obtain both D1 and D2.

Make sure you use a Cryptographically Secure Random Number Generator such as /dev/urandom.


Yes an open UPnP-port is a potential vulnerability. There is a broad range on how to exploit the UPnP-protocol.Read this link for more information: UPnP Networking Flaws Expose Tens Of Millions Of IPs To Hack Attacks
Read more at http://www.silicon.co.uk/workspace/upnp-attacks-over-networks-rapid7-security-105786#Wi3XEMHgsbw0VXKw.99
If you don't need it to be open for some reason close it.


Any ways to exploit PHP through an echo'd parameter?

This is a cross site scripting (XSS) vulnerability, which allows exploitation of the client (web browser) and cannot be used to (exploit php) compromise the website directly. It may however be possible to use this XSS as a staging point to attack other parts of the website, for example through hijacking an administrators session identifier or cross site request forgery.


Why would the downloaded certificate show a different end-date as compared to the same certificate when viewed online?

Dan Kamisky discovered and blogged about a very similar issue three months ago with Facebook.   He tracked down the issue to Facebook fielding some test load balancers based on old expired VeriSign certificates.  As always with his writings, the sleuthing is well done and presented in an excellent read.    The bottom line in his case is there was no threat.   The blog entry is a great read blog link


How do I securely erase USB flash drives?

UPDATE: Upon looking back it looks like using random data is not really necessary as a successful platter-level 'previous state' attack on a zeroed drive has yet to be proven possible in a real-world attack.

I've left the references below for posterity and because it does technically work fine if you're using random data, but given that just using 0s is much faster, that's probably the more reasonable option.

Flash storage, particularly SSDs, require a block/cell be wiped before more data can be written. As a result, writing would be slow if additional technology wasn't implemented.

Instead, your drive actually has 10-20% more storage than the listed capacity and an onboard memory controller will dynamically map empty cells and, during low load, wipe unmapped ones. This creates the security issue that you've encountered.

Without a tool that can leverage the memory controller your OS has no way of addressing every single cell at any given time. Many manufacturers are now providing tools that will allow you to manage the drive and securely wipe it but should your drive not have such a tool there are few perfect workarounds.

Aside from reverse-engineering a tool to manage the memory controller the best method I know of is to do many successive writes.

dd if=/dev/urandom of=/dev/devicename

Filling the drive with random data and then doing so again and again will cause the drive to constantly remap the cells and eventually you'll overwrite enough of them to be reasonably secure. The more successive overwrites the higher the chances that you will have written to every cell.

NOTE: Technically, these successive overwrites should also be done with a traditional HDD, but for a totally different reason. High accuracy equipment may be able to read previous magnetic states directly from the platter to recover data. This is why it's important not to overwrite with 0s or 1s, as it'll leave a easy to determine the previous state of the bits.

For an easier fix, throw the drive through a physical shredder. Obviously not a solution if you plan on reselling or reusing the drive but generally one of the most secure methods.


When to use SSL ? / When to send passwords via mail?

As a rule, if you run a website that requires authentication, you should run SSL.   And I'd debate your statement that SSL certificates are costly...I've just purchased one for a personal website of mine for less than 15 euros for two years.  It's cheaper than the domain name is, in fact.

You shouldn't send passwords via email either.   It's slightly more secure to email password reset links instead.

The real issue is not that someone might get Granny's forum password, but that Granny is statistically likely to have used that same password for her banking website.  And we can't have that stolen.


Access client certificate stored on another computer

With regard to the comments under my question, I suppose the answer from @SteffenUllrich is the right one:

  "... one client certificate per one company is correct ..." - it might
  be correct from the standpoint that you want to do it this way but it
  is not correct from a standpoint on how client certificates are
  supposed to be used. By trying to use these in a way which is not
  intended you create the problems you currently have and which you are
  asking us to solve.


Is is possible to shuffle an AES ciphertext without owning the key for it?

No, this is not possible. If you change a single bit in a block that is put through the cipher then all bits change with a certainty of 50% (each) due to the avalanche effect. So even though only one bit will be changed in the next block, the current block will still "completely" change.

Differently said, AES is a block cipher and a keyed block cipher is a pseudo random permutation. If you change even a single bit you get another mapping to an entirely different value for that block. Only one block leads to the same plaintext block, there is no redundancy. Because of the pseudo-randomness you get an entirely different plaintext block, no matter how many bits you change.

Some padding modes are redundant though (the most common one, PKCS#7 compatible padding isn't). So there is a chance that an attacker can change the last few bytes of the plaintext. For instance, you'd have a ~ 1 / 65536 chance that you'd create an ISO 10126 padded message that is identical after unpadding (the first byte identical and the last byte indicating 15 padding bytes).

Obviously using an authentication tag / message authentication code (MAC) over the ciphertext should be considered to be secure against any of these attacks.


Reverse proxy sharing one certificate for multiple servers using Subject Alternative Name

In such a case when multiple websites are served from the same server on the same port, that server differentiates between them by comparing the Host: header in the HTTP request.

Once TLS negotiation has occurred, it is not possible to read anything inside that request. You further cannot swap between two simultaneous SSL connections because a simple Diffie-Hellman key exchange produces a different key for each negotiation.

This is the crux of the issue: the Host: header is within the SSL encrypted transmission. Therefore, it is not possible to tamper with that header and not possible to redirect that request even to a different VirtualHost on the same machine.

Without the Private Key, there's not a lot you can do to break SSL.

EDIT: Yes. What you're suggesting would require some sort of tampering with the request. SSL basically consists of a TCP packet with an entirely garbled content, and what you want to do in this case is alter the garbled content to illicit a different response from the server. That isn't possible without breaking SSL. The only alteration you could make is to the TCP header to change the destination IP or port, but in your case that won't accomplish anything as you still intend to target the same service on that same server.

Clarification On SSL Negotation

The SSL negotiation uses a different key each time. Basically, the client generates a random number and encrypts that using the Public Key. This can only be decrypted with the Private Key. At this point, only the Client (who generated the key) and the server (who was able to decrypt that with its own private key) know this random number.

There is no way for an attacker to get that number. You could, theoretically, repeat that same encrypted secret to the server to open up a connection using that same key, however you still would not know the secret nor would you be able to alter any packets encrypted with it.

This would, however, allow you to use a replay attack (and repeat a request like "delete next item" again), so my guess is that there are other features within SSL to mitigate this risk.


There are already some projects developed that are targeting your goal of safety. You should look at my old post.

For Type-2 hypervisors, there is RoboLinux project which has an unique feature called Stealth VM. Stealth VM software installer that allows you to build a Windows 7 clone running in a secure Linux partition. The system is protected from malware, anything you download will be contained within the virtual machine and it is intended for people who must have a specific Windows program with the convenience of being able to restore the operating system as new in just two clicks.

There is Qubes OS which is developed on Linux and Xen as an example for Type-1 hypervisors. Qubes OS takes an approach called security by isolation, which in this context means keeping the things you do on your computer securely isolated in different VMs so that one VM getting compromised won’t affect the others. Unlike Type-2 hypervisors, it has a secure inter-VM file transfer system to handle sharing folders' risk. In theory, that organization is more secure than Type-2 virtualization according to developers.


SRUM (system resource usage monitor) forensics - Windows server?

The file you're looking for, %systemroot%\System32\sru\SRUDB.dat, is managed by the Diagnostic Policy Service. If the file isn't present, you may find that service isn't running.

Take a look in services.msc and check to see if the service is running. Diagnostic Policy Service should be able to create the missing file when run.


When is phishing education going too far?

I think there is an underlying problem that you will need to address. Why do the users care that they are failing?

Phishing simulations should, first and foremost, be an education tool not a testing tool.

If there are negative consequences to failing, then yes, your users are going to complain if the tests are more difficult than you have prepared them for. You would complain, too.

So, your response should be:

educate them more (or differently) so that they can pass the tests (or rather, the comprehension tests, which is what they should be)
remove negative consequences to failing

This might not require any content changes to your education material, but might only require a re-framing of the phishing simulations for users, management, and your security team.

Another tactic to try is to graduate the phishing simulations so that they get harder as the users are successful in responding to phishing. I have done this with my custom programmes. It's more complex on the back end, but the payoffs are huge if you can do it.

Your focus needs to be the evolving maturity of your organisation's ability to resist phishing attacks, not getting everyone to be perfect on tests. Once you take this perspective, the culture around these tests and the complaints will change.

Do it right, and your users will ask for the phishing simulations to be harder not easier. If you aim for that end result, you will have a much more resilient organisation.


My server was hacked and I am asked to pay to recover my files

Depending on how the files have been deleted (and your file system) there might be forensic tools that evaluate the journal and retrieve as much information still alive behind the scenes of the filesystem.

For example, if you are using ext3 or 4, extundelete may help when the attackers were sloppy with deletion and didn't overwrite the files.

There are some steps to be taken to prevent this; some of them are:

always keep your system up to date and apply all security fixes
disable all unnecessary access methods (for example ssh password auth)
have a firewall in place that only allows specific ports and protocols to be used
have a backup in place to just wipe the system and start fresh without loosing the data

As has already be mentioned, this is a crime (blackmail, and in many jurisdictions the break-in is actually a crime as well), so you should inform law enforcement.

Also, do not pay them - there is no guarantee they actually will give you the files after that; they most probably won't - or ask for more money.

Side note here:

If user data has been compromised, this might result in legal issues for yourself/the company. The best way to go about this is to be open with law enforcement about everything.


What is the way to know that the endpoint is down if there is an L4 / L7 balancer?

I don't think is really possible nowadays, when you make a TCP connection to a server, you may thing thats the endpoint, probably that TCP connection is balance to other systems that depending on the policy of the load balancer could be the same physical host or not. This policies sometimes are dynamic and may vary depending on the load, so your HTTP Request could go to different endpoints depending on how is design the backends.


Is CA the only way to securely share public key?

A CA is not a way to share a public key in the first place. The idea behind signing a certificate (which contains the public key) by a CA is to propagate an existing trust into a CA to the certificate. How the signed certificate is then shared does not matter because nothing is secret in it and the recipient can detect any modifications since these would invalidate the signature from the trusted CA.

In practice there are many ways to securely share a public key. The main requirement is that the transport or container can be trusted trusted and that it protects against manipulation of the contents. This can be achieved when communicating with TLS  with a trusted server, by sending the key inside an S/MIME mail signed by a trusted sender, by signing a certificate by a trusted CA etc.


Concerns regarding a password manager web app

If someone discovers a vulnerability in a browser that lets an attacker read data across web page/tab boundaries then there's a risk that they'll be able to extract information from it.

A browser is essentially a container for applications so all those security implications apply.


Is it possible to remove data from specific folders on any unauthorized login attempt?

No. If you can access the system to remove the administrator password, then you can simply access the drive without the method/software to delete the files.
Since you ask about specific folders, you can protect those by encrypting them with something like VeraCrypt and set a unique password for it. That way, if someone gains access to your system they do not automatically gain access to those folders.


Is it unsafe to parse user input without checking for correctness?

No, authentication is not a sufficient compensating control for lack of input validity checking.

You can't always usually ever trust input from users and and other systems (and I recommend not trusting input from your own system, as well).  As an example, I've had roughly 5 instances in the last three months where a trusted user's system acted as an unwitting conduit for a scan or attack.  In one case, their system was carefully tucking malicious input from a third party into valid (schema-appropriate) XML and forwarding it under their credentials.  Oops!

You may not know what to expect for the valid content of the data but you should be able to look at both the structure of the data and invalid content of the data.

Structure - If it's a phone number, zip code, SSN, or other structured data, you can do syntax checking to make sure it fits the appropriate pattern.

Invalid Content - If it's unstructured text, you can validate size, and you can look for and quote metacharacters that are often used to abuse parsers and processors (`, ;, (), {}, &, <>, etc.).  This is a difficult task to do comprehensively, which is why the Web Application Firewall market has sprung up - it offloads the scanning of content for malicious strings to a specialized tool that can focus on the task.


Short answer
Yes, they can.
Long answer
If you require PIN to do any transaction, they will have your cards' information, but they can't really do anything about it.
Of course this is already bad, and it doesn't improve situation in any level. If it was a credit card that requires you to put zip code only (for example, US credit cards), then they can guess where you used credit card and punch that zipcode.
Also if you read suggested thread below, you will see how they steal PIN.
I don't live in UK, but this applies to any card reader that uses magnetic strip.
That's why card issuers are strongly recommending use of IC instead of magnetic strip.
Read this thread to avoid being a victim.


Why does my stack contain the return address to __libc_csu_init after main is initialised?

Your main function contains pointer to __libc_csu_init just before its return pointer, because that's how stack frame works;
before entering a function, caller pushes a stack frame pointer and a return pointer.

Return pointer contains an address, to which function will return on
function finish.

Frame pointer contains the address of the previous top of the stack, so it would know to where it should rewind the stack.

Unlike return pointer, stack frame pointer doesn't neccesarily need to be pushed on stack (its address can be stored in registers), but can be helpful for optimization, since accessing some address from current stack would be a matter of substracting from its value.

On the image below, that is example function call stack, stack frame pointer would be pushed where the "Frame pointer" arrow points - author assumed, that it would be stored in register only. If it was your program, it would contain address to __libc_csu_init.

For more information on frame pointers reffer to the Wikipedia article:
https://en.wikipedia.org/wiki/Call_stack

And now, for a proof, let's compile a simple program with -fomit-frame-pointer flag (forces behaviour as in the image above), and without (pushes the frame pointer on the stack, like in your program):

int main(int argc, char *argv[])
{
// placing nop instruction just for readibility of disassembled code
asm("nop");
}

Compiled with no-pie, so PIC would not prevent me from breakpointing:

g++ answer.cpp -o answer -fno-pie -fomit-frame-pointer

Disassembled in gdb, breakpointed on the line with 'nop' instruction and printed first 12 words after stack pointer:

(gdb) disassemble main
Dump of assembler code for function main:
   0x00000000004004b2 <+0>: mov    %edi,-0x4(%rsp)
   0x00000000004004b6 <+4>: mov    %rsi,-0x10(%rsp)
   0x00000000004004bb <+9>: nop
   0x00000000004004bc <+10>:    mov    $0x0,%eax
   0x00000000004004c1 <+15>:    retq
End of assembler dump.
(gdb) break *0x00000000004004bb
Breakpoint 1 at 0x4004bb
(gdb) r
Starting program: /home/xdbeef/answer

Breakpoint 1, 0x00000000004004bb in main ()
(gdb) info registers ebp esp
ebp            0x4004d0            4195536
esp            0xffffdae8          -9496
(gdb) x/12xw 0x7fffffffdae8
0x7fffffffdae8: 0xf7a2d830  0x00007fff  0x00000000  0x00000000
0x7fffffffdaf8: 0xffffdbc8  0x00007fff  0xf7ffcca0  0x00000001
0x7fffffffdb08: 0x004004b2  0x00000000  0x00000000  0x00000000
(gdb) x/12xa 0x7fffffffdae8
0x7fffffffdae8: 0x7ffff7a2d830 <__libc_start_main+240>  0x0
0x7fffffffdaf8: 0x7fffffffdbc8  0x1f7ffcca0
0x7fffffffdb08: 0x4004b2 <main> 0x0
0x7fffffffdb18: 0x161e93edeaec9201  0x4003e0 <_start>
0x7fffffffdb28: 0x7fffffffdbc0  0x0
0x7fffffffdb38: 0x0 0xe9e16c9256ac9201
(gdb)

As you see, the first and only address on main's stack frame was the return pointer.

And now with frame pointer:

g++ answer.cpp -o answer -fno-pie

(gdb) disassemble main
Dump of assembler code for function main:
   0x00000000004004b2 <+0>: push   %rbp
   0x00000000004004b3 <+1>: mov    %rsp,%rbp
   0x00000000004004b6 <+4>: mov    %edi,-0x4(%rbp)
   0x00000000004004b9 <+7>: mov    %rsi,-0x10(%rbp)
   0x00000000004004bd <+11>:    nop
   0x00000000004004be <+12>:    mov    $0x0,%eax
   0x00000000004004c3 <+17>:    pop    %rbp
   0x00000000004004c4 <+18>:    retq
End of assembler dump.
(gdb) break *0x00000000004004bd
Breakpoint 1 at 0x4004bd
(gdb) r
Starting program: /home/xdbeef/answer

Breakpoint 1, 0x00000000004004bd in main ()
(gdb) info registers ebp esp
ebp            0xffffdae0          -9504
esp            0xffffdae0          -9504
(gdb) x/12xw 0x7fffffffdae0
0x7fffffffdae0: 0x004004d0  0x00000000  0xf7a2d830  0x00007fff
0x7fffffffdaf0: 0x00000000  0x00000000  0xffffdbc8  0x00007fff
0x7fffffffdb00: 0xf7ffcca0  0x00000001  0x004004b2  0x00000000
(gdb) x/12xa 0x7fffffffdae0
0x7fffffffdae0: 0x4004d0 <__libc_csu_init>  0x7ffff7a2d830 <__libc_start_main+240>
0x7fffffffdaf0: 0x0 0x7fffffffdbc8
0x7fffffffdb00: 0x1f7ffcca0 0x4004b2 <main>
0x7fffffffdb10: 0x0 0x716825b9b97d27b5
0x7fffffffdb20: 0x4003e0 <_start>   0x7fffffffdbc0
0x7fffffffdb30: 0x0 0x0

Now, the first address on main's stack (frame pointer) was to __libc_csu_init, and the latter (return pointer) to some place in __libc_start_main, from which the 'main' function was called.

Btw, don't have enough reputation to comment on other's answers, but user189437 posted (and not credited the original author, eh) a snippet from very good post on Patrick Horgan's blog, that explains how C applications are bootstrapped:

http://dbp-consulting.com/tutorials/debugging/linuxProgramStartup.html

My another remark is: by invoking
info proc map
in gdb, when breakpointed at nop instruction, you'll probably see that __libc_csu_init isn't on the stack, but in the section where program instruction lies. That makes no sense, since we can't rewind stack there! Well, that's probably some part of program-startup magic, that sets initial frame pointer.

There's a book on that very specific topic, though I didn't read it, from the few pages I've seen it covers program startup (calling _start & libc_start_main ):

https://books.google.pl/books?redir_esc=y&hl=pl&id=YZIoDQAAQBAJ&q=libc+hlt#v=snippet&q=libc%20hlt&f=false

Hope that cleared things out!

Regards,
Daniel


What "timing attacks" could websites perform using last modified dates of files?

I don't think there is a timing attack specifically against File.lastModified. I think the reduced precision of the lastModified field is an effect of a mitigation for all kinds of timing attacks.

Spectre/Meltdown were exploitable from JavaScript, by timing certain statements. For this, you would need high-precision timing. To solve this issue, Mozilla reduced the precision of the timer with privacy.reduceTimerPrecision. This must affect all timers: if the someFile.lastModified is more precise than new Date() or some other timer, you could build a precise timer by changing a file and then looking at the lastModified.


Why would a U2F key be more secured than an OTP device?

One of your main points is valid: if the USB key is stolen with your device, it may still be game over if other credentials are known. Personally, I am not concerned about loss or theft of the USB token, since it doesn't really weaken security if used as a second factor, plus access can be revoked and some features may require a PIN.
However, the USB token is superior to a phone in that it cannot be compromised remotely and have its secrets dumped. Also, FIDO2 provides a layer of protection against phishing attacks that OTP simply cannot provide.


The idea of refresh Tokens is you use them only once - to get a new refresh token and a new Auth token. This way the token to go on was never used before and can only be used once.

https://tools.ietf.org/html/rfc6749#section-1.5

The Authorization Server serves them as a response to the authorization grant, if requested by type. This step can be skipped and you can directly request Auth Tokens. But Auth Tokens are not supposed to be exchanged for other grants.


Why does the file "shell.php.jpg" can execute as a php file but "shell.jpg" cannot?

shell.php.jpg should be treated as a .jpg file

You're exploring DVWA, so not every should be means is. If I had to guess, the upload script properly checks the extension of the file and allows it, but the webserver doesn't check it the same way and allows execution.

You can learn more by exploring web server's (nginx or apache) config files, look for a block that performs handover to php parser for request processing.

Clarification:

  But why can I execute this file and not a shell.jpg file if the file extension stayed the same and the .php part is just part of the file name?

The extension is just letters in a file name, they do not determine how the file is handled by the web server, web server determines it. One of the common algorithms is:

If the requested file name ends with “php”
    Invoke php to handle the request
Else
    Serve the requested file like any other static file
End

I’m guessing that in your case requested file name ends with “php” is changed to requested file name contains “.php”. You can find this rule in the configuration file of the web server that’s processing your requests and find out for yourself.

Update:

This is the expected and documented behaviour of apache. I'm a little bit surprised, but this is the world we live in. Goddamnit.

In configuration file /etc/apache2/mods-enabled/php.conf line AddHandler php5-cgi .php registers handler for .php files. Everything is OK, unless you read what AddHandler does.

  The extension argument is case-insensitive and can be specified with or without a leading dot. Filenames may have multiple extensions and the extension argument will be compared against each of them.

Sooo... Yeah. Of course filenames may have multiple extensions. This is the only logical default.

If you're a weirdo expecting that the file would have only one extension, apache has the answer for you:

  If you would prefer only the last dot-separated part of the filename to be mapped to a particular piece of meta-data, then do not use the Add* directives.

They helpfully suggest the solution to your weird wish of one-extention-ness – just use regex. So in order to execute only .php files as php you need to replace AddHandler directive in php.conf with

<FilesMatch "[^.]+\.php$">
  SetHandler php5-cgi
</FilesMatch>

In conclusion:

common sense doesn't exist in software
never trust any data provided by user
store original filenames in the database if needed and rename them after upload
treat filenames like a live bomb


The restrictions on how security should be implemented when assessing the security of an application, heavily rely on the regulation to which the application needs to be compliant would. General security recommendations can be found in the OWASP guide.

To be able to assess each of these recommendations you would need access to the source code. If your vendor does not want to give you access to the source code, you can inquire if an independent company has performed a penetration test or audit on the code.

Mind though that additional restriction can apply if you are storing data within the application. For instance you have FIPS140, HIPAA, PCI-DSS,... which all may have more strict requirements on how data should be processed by your application.


How and why do people spam my website form?

They spam your (mine or everybody's) website because in the end it pays. Maybe because your visitors click on the URL, maybe because their own website gets a higher ranking on Google (because of many websites linking to theirs). It is not because it is your website, it is because they found a way to inject information easily (through a script or so).

Because their cost is extremely low (usually all systems they use are not owned by themselves, but compromised systems all around the world). They need only a handful of paying visitors in their own shop for maybe every 1000k+ spam messages they leave. Think about spam in global scale, not precisely your website. Yours just happens to be in their path.

For every more or less standard website (for example, based on phpBB, Joomla, Drupal, Scuttle, ...) if there are many installs on the Internet, it pays to develop a script to spam. Google will find the vulnerable sites for you. Browse through your webserver logs, and pay attention to referrers that mention Google. Study the query that got them to your website. You'll be surprised what search terms they've used to find your content.

The only reason why spam exists is because in the end it pays good money (at least for someone).


Why isn't it possible to do SQL injection (HIGH Level) in this example in Damn Vulnerable Web App?

The high level is meant to be the secure implementation and should be unbreakable.

Looking at the source code you can see that there is verification that $id is a number.

if (is_numeric($id)){

        $getid = "SELECT first_name, last_name FROM users WHERE user_id = '$id'";

Therefore it is not possible for the id parameter to be changed to anything that will break the parameter out from the data value context and into the query context.


How is the same origin policy causing my PoC to fail when I don't need to read return data?

There is no reason that this should not work as long as third party cookies are enabled in your browser.

HTML form POSTs can be used, or in the case that the forms are a multi-stage process then this will be more useful to run as XHR requests as your attacking page can then control the requests and issue them in turn - just as your are doing.

Make sure that you are setting withCredentials on your AJAX requests.

In jQuery this is done like the following

$.ajax({
  type: "POST",
    url: 'http://www.example.com/Controller/Action',
    data: 'foo=bar',
    async: true,
    xhrFields: {
      withCredentials: true
   }
});

Other answers suggest that using withCredentials means that a CORS pre-flight request is sent to the resource instead of the intended GET or POST. This is not the case as long as the request is a "simple request". If your exploit worked with HTML forms then the correct AJAX equivalent would be a simple request, so check that all you code is correct.

  Cross-origin requests come in two flavors:

  simple requests
  "not-so-simple requests" (a term I just made up)

  Simple requests are requests that meet the following criteria:

  HTTP Method matches (case-sensitive) one of:

  HEAD
  GET
  POST

  HTTP Headers matches (case-insensitive):

  Accept
  Accept-Language
  Content-Language
  Last-Event-ID
  Content-Type, but only if the value is one of:

  application/x-www-form-urlencoded
  multipart/form-data
  text/plain

  Simple requests are characterized as such because they can already be made from a browser without using CORS.

This is actually mentioned in the CORS specification and indicates that CORS does not actually add security, it only enables cross-domain communication when both the client and server opt into the specification. If both parties do not opt in (such as in a CSRF attack where the victim site does not wish to be communicated to in this fashion), then the browser will act in a similar way to pre-CORS. i.e. cookies will be sent although the response will not be readable:

  resources conforming to this specification must always be prepared to expect simple cross-origin requests with credentials. Because of this, resources for which simple requests have significance other than retrieval must protect themselves from Cross-Site Request Forgery (CSRF) by requiring the inclusion of an unguessable token in the explicitly provided content of the request.

Back to your question:

  I compared the actual HTTP requests for both content and order - all of the application layer data matches.

I suggest that you use an intercepting proxy such as Burp or Fiddler2 to verify the requests. Checking the requests from inside the browser is not an accurate way of verifying this because the requests viewed in Chrome are subject to be interpreted from the Origin of the page they are issued from and if the Origin doesn't see the response due to the Same Origin Policy, then neither will you in dev tools. Chrome informs you of this via the “CAUTION: provisional headers are shown” message.

For example, the following is the same request as shown in Chrome dev tools and then in Burp. Notice how only the external tool shows the cookies.

I've tested this behaviour with Chrome 38, Firefox 32 and Internet Explorer 11 on Windows 7 x64, and it is consistent across browsers (however, make sure 3rd party cookies are enabled in settings) so this is further indication that this behaviour complies to current standards.

So my advice is to double check your code and requests using an intercepting proxy. Maybe post them on here for another pair of eyes to check as if it is working one way but not the other then there must be a mistake somewhere because the requests will not be the same.

Also, make sure that your code isn't exiting early due to the error returned because of Same Origin Policy violation.


Firewall tiered architecture and firewall brands in today's context

... Firewalls are not the targets anymore...

Broad claim and I would suggest it is wrong. A single firewall has a strategic position in the network as it is reachable from inside and outside. Thus compromising it from outside gives you full access to the inside. Sounds like an ideal target for me. Having a second firewall which limits attacks from outside to the internal network could definitely help in case the first firewall got compromised. But without the second firewall the attacker has unrestricted access to the internal network.

Apart from that no firewall is foolproof and by combining firewalls you might have a better protection, similar to combining antivirus from different vendors. As a side effect of my research (bypassing firewalls at the HTTP layer) I've noticed that a multi-layered approach can help to reduce the evasion possibilities. But I've also noticed that different vendors often make the same mistakes, which means that multiple layers will not necessarily help to make the protection more robust to evasions.


How password_hash / password_verify can work with any arguments (PHP)

How password_verify can know the algorithm used, the salt and the
cost?

$save_hash looks like this:
$2y$10$nmqlFAguURkkWhjgn7LP7.QxLw2fQ9GYSkiaEbypgXg6L4bESC.Mu

Which is a bunch of fields separated by $:

What
Means this

2y
Type of hash, in this case bcrypt

10
The cost

Salt and password hash
The first 22 characters are salt, the remainder is the hash

So, yes, all the information required to mount a brute-force attack on the password is there.

But I don't really understand why all that information is included in
the hash, so a possibly attacker will know too. So, if attackers know
the salt, why is it secure?

The salt is not designed to be secret; it is designed to be distinct for each user, meaning that an attacker will have to adjust their attack for each user.  Without salts, every user with "p@ssw0rd" as their password would have the same exact hashed password, and the attacker would only need to crack it once.  With salts, the attacker has to do the work separately for each user/salt.
As an example, let's take 100 users.  Without salts, an attacker needs 10 tries to test 10 passwords.  With salts, the attacker needs 1000 tries to test 10 passwords.  The cost of the attack is multiplied by the number of salts.
See also this question about salt.


How to build arbitrary Dockerfile Images Without Compromising Host

I'm going to state the obvious here and just say, "don't include /contents/of/host/secrets in your builder VM." Presumably, though, you've got something going on that makes the obvious answer less obviously correct.

So let's circle back to the other obvious bit, and point out that "arbitrary Docker build" is literally "arbitrary code execution", since the Docker build process is imperative (not declarative), and having your dockerfile do things like downloading and executing arbitrary code off the internet is Totally A Thing™ in the Docker build world.

In other words, the whole Docker build process is potentially malicious, so you should be thinking about it in terms of sandboxing attacker-provided code. You need a strong security boundary between the builder's (attacker's) runtime environment, and virtually everything else. You've heard that docker containers aren't a security boundary, but attacker-controlled docker containers don't even pretend to be a security boundary. The builder needs to run in its own VM, and all the access between it and your own systems needs to be mediated by well-defined communication channels; no back-door access.

With that in mind, lets think back again to /contents/of/host/secrets. The docker build runs on the builder VM. The VM is isolated because you don't trust it, and it has no access to secrets which you haven't intentionally shared with the attacker. There's your sensible solution.

For cleanup: Just delete the VM. Restart it again from your "pristine" HD image.

Since the wheel you're inventing has been invented many times before, I'd recommend looking over the existing solutions for ideas about how they solved the problems that you come up against.


Rather than use triangulation, which would work, it's probably much easier to use a directional antenna. This and a tool like Kismet which can show you signal strength is a far quicker way to locate these devices. For bluetooth you would use an ubertooth and a directional antenna for the appropriate frequency.

https://www.kismetwireless.net/

https://en.wikipedia.org/wiki/Directional_antenna

https://greatscottgadgets.com/ubertoothone/

What you mentioned would work but it requires more equipment and more setup to work well. Both are valid solutions but I think because directional antenna's are cheap and easy to use they tend to be the solution of choice.

Note: If you wanted continuous monitoring, without a human involved to move a directional antenna, then triangulation would be the way to go.

Per your question about the app. You don't need to sniff packets but you do need signal strength there are lots of app's that either show signal strength as a bar graph and there are some which measure it in decibels either could work but you'd have to move around a lot more because the built-in antenna isn't directional. It could still be done but probably not nearly as quickly.


The security appliance report should say somewhere what standard it is using for the industry names. I am not sure how many standards are out there and it also depends on what kind of weaknesses your software is scanning for, but commonly I´ve seen reports using:

CVE (Common Vulnerabilities and Exposures) http://cve.mitre.org/

or

CWE (Common Weakness Enumeration) https://cwe.mitre.org/


What are the risks of posting family pictures online without any access control?

Well, other than the standard geolocation stuff and other metadata you should remove from the images and people being able to guess your location just by the image background, I don't see any.

That being said, with stuff like google crawlers, these images can be very easily harvested and facial recognition can probably associate them with you if you the company (FB) has pictures of you already.

And if you post links to them on social media, then to correlation would be even much easier. But if you do this, there is an interesting solution. Use a key to access the photos and just put them in the link. Something like: mypage.com/photos/my_holiday_photo.jpg?key=tGJ4sNcUYYz2Xagt


Security is defined as the state of a system in which confidentiality, integrity and availability of data is granted.

Privacy is the ability of a natural person to control the distribution of his or her personal information.

If you are using for example a system of a big company - let's call it Oogle - it might be that their system is pretty secure, but doesn't respect your privacy at all because they sell your data.
On the other hand, you can have open source software which does not store any user information - so you know it's granting privacy, but this could still be insecure if someone exploits a bug in it.


How to exchange private keys between server and clients?

Do not attempt to implement key exchange on your own. You should be using a standard library which makes this easy, such as libsodium. See the documentation on how to do that.


How secure is Android's facial recognition?

You've already done enough research to see that facial recognition on android is easily circumvented. I've read (although I cannot find the link now) that researchers were able to defeat it by using picture of a similar looking person, not even the actual person. When you think about it expecting facial recognition to work on a device with limited resources, and when it's expected to work in a fraction of a second, is a tall order. I'm sure it will eventually get there, but for now it isn't strong.

I do think that before you rule it out completely you should consider what it is you are trying to protect. Most phones are stolen for the express purpose of being sold on the black market and not for the information on them. Most get wiped without anyone even attempting to get data off them. Given that a thief would need to somehow obtain a quality picture of their victim in the correct pose in order to be able to unlock the phone it seems likely that facial recognition would be "good enough" security for many people as it raises the difficulty bar sufficiently.

If an attacker really wants access to someone's phone and has the time and resources to get a picture of the owner, facial recognition isn't going to prevent access. So if you have information on your phone that someone would really want, or have a duty of care to protect the information on it then don't use facial recognition. If your phone has nothing of interest then why not use it?


In what cases can overly strict security policies be detrimental to organisations?

What you are pointing is the difference between imposing security rules to people and involving people to get better security.

Chances are that you will find this video quite interesting. After a walk through issues quite similar to the one you mention, the presenter (Jayson E. Street to name him) ends up by talking about positive enforcement. It makes the difference between a few administrative people trying hopelessly to make all the "stupid users" to comply with imposed rules, and the same administrative people considering the other employees as co-workers, or even a "human IDS".

If people do not understand the goal of a security measure or do not feel it to be useful, they will never apply it (or at least they will never apply it in a sensible way).
If people have the feeling that a security measure prevents them from doing their daily job, they will just workaround it.
If people have the feeling that this security only comes in a top-down direction, they will be far from likely to raise any issue or suspicious event.

That's why security literature insists on the role of regular trainings in order to educate people. Security is not here to please management and auditors. Security is here to ensure the safety of the company, of the customers, and ultimately of the employees themselves.

Better security is not achieved by defining always stricter rules. Better security is achieved by getting people involved.