Can anyone explain what Ret2plt means and how it works? I'm reading about stack overflow protection mechanism like DEP, and it's written that Ret2plt and system() can be used to bypass it.

What is Ret2plt and how does it work? I cannot find a single explanation of this term on google.

In short, jump to the address of the PLT entry for the function = call the function.

Ret2plt is a similar concept to Ret2libc regarding DEP. DEP/Data Execution Protection works by making some memory non-executable (heap, stack..). This works to prevent code execution if the malicious code is smuggled into those non-executable areas. But if we could call code that has to be executable, like libc code, then it will be executable. At the assembly level we could even pass it our own parameters.

Described here: Rafal Wojtczuk, 1998, return to PLT uses the procedure linkage table to indirectly call libc functions.

The PLT is necessary because library code is not loaded into memory at fixed addresses, usually it is position-independent code (PIC). So procedure calls into shared libraries are made through the PLT. If we return into the PLT, then we are effectively calling those shared libraries linked by the PLT.

The main limitation is that you can only call functions that are already being used by the program, or else they won't have a link in the PLT.


Securely expose WebService from Enterprise Network to Internet Client (coming from stackoverflow)

Are there any standards (or certified solutions) to expose a (Web-)Service to the internet from a very security-sensitive network (e.g. Banking/Finance)?

I am not specifically talking about WS-* or any other transport-layer security á la SSL/TLS, rather about important standards or certifications that must be obeyed.

Are there any known products (coming from an SAP-environment) that can provide a "high-security proxy" of some sort to expose specific web-services to the internet?

Any buzzwords that a CIO/CTO is aware of about this subject?

Whilst the answer given by AaronS gets to the gist of it (rather harshly if I may say so), I think the general principle that applies to any secure solution is defence-in-depth. That is, using several layers of security to prevent against attack, compromise or data leakage.

I'm not going to go into the debate of what percentage of attacks/leaks are internal, but whatever it is, this should not be forgotten or ignored either. You might follow AaronS's suggestion and 'never open your LAN to the internet' and put the server on the DMZ, and an employee might still be able to dump your database onto a memory stick and walk out the door with it.

So if you're looking for buzzwords, I would start with making sure you have network protection (e.g. Firewall, Intrusion Detection/Prevention) in place first, apply all the necessary patches and updates to your software and OS (Hardening). Use network segregation to separate your applications so that data flow is tightly controlled (DMZ is one common example, but other network segmentation models also work). Make sure the web service is developed securely, tested and code reviewed. Even with the best firewall and DMZ in the world, if the application itself is vulnerable, then most of this protection might have limited effect. Since the external facing web service will likely consume data or communicate somehow with internal components, make sure the same methodologies apply to them too. Make sure Authentication and Authorization are used to control access to data. Make sure you have solid monitoring and logging in place... The list goes on. This is by no means a substitute to a proper security architecture / analysis, which the security people in your organisation should be able to perform.

As for the 'high security proxy' you were asking about - there are a few products that provide application layer protection, see Application Firewall on Wikipedia. Those can also be added to the mix, but I would not rely solely on these for your security.


XSS Injection invalidate meta redirection tag When injecting into the url part of an HTML META redirect like this:

<meta http-equiv='refresh' content='0;URL=$URL'

where $URL (note the missing quotes) is the part I can inject, is there any way to invalidate the meta tag so it does not redirect immediately and instead run the injected JS?
I already tried injecting the content attribute again with a different redirect time, but at least for chrome, this does not work.

Seems like using something like:
javascript:alert(1); as the URL, then closing the meta tag and opening a new script tag for the XSS works.


Is it possible to take over the victim's system only by DNS attacks? I found this article and it describes some DNS attacks.
Those are mainly targeting login credentials, banking information, and so forth.

By redirecting the victim to a malicious site it could be also possible to take over the whole system, as far as I understand.

Still, if my browser is secure (no js enabled, no pictures, all plugins deactivated) I should be safe, right?

Are there also attacks that could make it possible to take over a victim's system any other way then redirecting to a malicious website?

A successful DNS redirection means the attacker can redirect you wherever he wants.

He can setup a malicious website to exploit your system by various techniques. One example would be the recent exploits from Hacking Team; two 0-Days that can be used to exploit a fully patched machine remotely without any user interaction on all systems running Flash.

So no, you wouldn't have been secure even with what you've mentioned with someone redirected you to a website like that.

Seeing how 0-Days are discovered frequently in all programs, you could face the same situation anytime, anywhere.

Solution: DNSCrypt.

UPDATE: with all plugins deactivated, you would've been secure actually. It's good you're decreasing the attack surface, but still, that was one example. You get the idea.


WebAuthn - What am I missing? I'm trying to learn a bit about authentication and security protocols at a 10,000 foot level. I was reading about WebAuthn here: https://webauthn.guide/ and here:
https://webauthn.io/
I'm sure what I'm about to ask has obvious answers, because this protocol has been developed by smart people with probably decades of experience. But, I don't get the two questions in bold (or more likely, i don't get at least, the two questions in bold...):

What ties the user (i.e. the carbon based life form with some sort of uniquely 'you' property) to the key used in the registration attempt?

For instance, if the key is generated from an HSM, where is the step of providing something that only 'you know', rather than 'you physically possess but couldn't potentially be in the possession of others,' to verify that is your carbon life form submitting the key from the HSM for this registration attempt?
I.e. where is the passphrase, and how does needing to have that to tie 'you' to 'the key' in the whole registration process (and future login attempts) in anyway circumvent the use of passwords and all the management that goes along with them anyway?
All this boils down to needing to present something that clearly ties your carbon based existence, to the presentation of a strong key....I presume this is why Yubikey and co are going for bio-metric HSM's....(based on the security of many bio-metric implementations in the past and their relatively 'spoofable' nature, that prospect doesn't really fill me with certainty that it's fixing anything)....
And even then, why not just present the biometric data directly and do away with the middle ware of the WebAuthn crypto key in the process?...
(presumably because there is too much data in the actual biometrics, to punch it directly over slow networks, and/or proving that it hasn't been modified in transit requires key signing of the data anyway, so the keys are back on the table...?)

What prevents a Man-In-The-Middle from hijacking the registration process with their own credentials and key material?...and then just monitoring the transactions and relaying information, or even just sitting in the middle and being an 'evil proxy webauthn' server, or just taking ownership of the 'user representation' that you tried to register?

Obviously the user would become aware when they attempted to use the given service over a network that 'evil mitm proxy' hasn't managed to intercept, as the service that 'they registered for' with 'their key' will be reject the login attempt (since now the users actual key is being presented rather than 'evil mitm key')....but it's all a bit late by then isn't it?
I mean someone else at that point would own (in a cryptographic-ally verifiable manner) the service account. So, you'd know you've been screwed, but what are you going to do about it, particularly if that service is a publicly attributable front-end to your carbon life form (think Twitter, email, social networks or some sort of social security style registration of nation state recognised credential like a drivers licence or passport etc).

I'm thinking these problems are presumed to be solved by layering external technologies outside of the WebAuthn protocol. For instance the HSM requires bio/passphrases, and the registration happens over HTTPS.
So, is the presumption that these external mechanisms (arguably) prevent the above two scenario's, rather than the WebAuthn protocol itself?
How much of a stack is being relied upon, to achieve the goal of binding 'your carbon life form' to 'the registration for a service' such that is apparently 'your registration'?

I'm not an expert on this but here is how I understand it:
A) The short answer, "something you know" does not have to be present for WebAuthn to work. That falls into securing HSM-Harware Security Module (or any other Authenticator that supports WebAuthn). WebAuthn is not about that, at least in this stage.  HSM vendors can incorporate security features to protect their devices in case of physical access (biometric spoofing, copying etc) or phishing. That will be dependent on the need of the users on how much security they need (corporate IT admin vs. average home user). I'm sure FIDO will certify different level of devices for different needs, and maybe some companies will require HSM with certain feature-set, and maybe in the future the industry will move to a more secure option. After 20+ years, we're now seeing HTTPS replacing HTTP at a rapid pace for example. It's a start and work in-progress in my opinion.
Also, biometric data only unlocks access to HSM / Authenticator (i.e Windows, iOS) and it doesn't give anything else about the private keys stored. Spoofing biometric can only be done when having access to HSM and that falls into securing the device. This is versus someone hacking a company and dumping everyone's passwords. With WebAuthn, the credentials obtained are useless. (But they can replace your public key there with theirs and can have access to your account depending on how the web app' security is designed - still much less damaging than passwords being traded in dark-web). If you replace the public-private key method with just sending the biometric data to web apps, it is the same as having a very strong passwords but unfortunately, the same password and irreplaceable ( you can't change your own biometric like a password) in every web app you use. This brings a privacy issue (web app knows your biometric and they can abuse it), second you give it to everywhere (it makes it a single-password for all - once compromised it's over). Also, similar to passwords, if they can dump these biometrics, they can sell / access your account just like passwords, just harder to crack (like a very strong password)
The way WebAuthn securely do this is through asymmetric key pairs (similar to how SSL works today - only generated by user's device instead of a CA like GoDaddy): The keys are generated per web app on the HSM, the private key stays at the user's HSM and the public key is passed to the web service and the web service stores & uses it in the future to decrypt the requests coming for your account. What is signed/encrypted by private key can only be opened by the public key so the web app knows that the request is signed/encrypted by the same private key originally registered. Since the keys are per web app, phishing through spoofing another web app's login screen is not possible.
This takes away the burden of managing / remembering passwords from the end user. It, also, eliminates weak passwords, case of re-using across multiple sites, passwords on post-it, passwords being phished, etc. What's left is securing the authenticator (HSM or laptop, iphone, yubikey, etc.)
Here is how the W3C specs describes this. As you can see, "something you know" is not required at this point:
"Authenticators are responsible for ensuring that no operation is performed without user consent"
"User consent means the user agrees with what they are being asked, i.e., it encompasses reading and understanding prompts. An authorization gesture is a ceremony component often employed to indicate user consent."
"An authorization gesture is a physical interaction performed by a user with an authenticator as part of a ceremony, such as registration or authentication. By making such an authorization gesture, a user provides consent for (i.e., authorizes) a ceremony to proceed. This MAY involve user verification if the employed authenticator is capable, or it MAY involve a simple test of user presence."
"A test of user presence is a simple form of authorization gesture and technical process where a user interacts with an authenticator by (typically) simply touching it (other modalities may also exist), yielding a Boolean result. Note that this does not constitute user verification because a user presence test, by definition, is not capable of biometric recognition, nor does it involve the presentation of a shared secret such as a password or PIN."
You can read more here. Start from the abstract and follow from there
https://www.w3.org/TR/webauthn/
B) If there is a Min-In-The-Middle (MITM) actor present before you register to a service and they are able see / modify your communication with a web-site, they can already own your account and after WebAuthn registration, they can continue to own your account by replacing your public key with their public key at the time of registration. But this is only possible if MITM can read clear text communication between the parties (i.e. already spoofing SSL between the parties). At this level, no solution through the same channel (i.e. web) will help. I don't think this is a problem or a shortcoming of WebAuthn itself as it's not its job to overcome a well-established MITM. A second factor authentication could help with this but if the same MITM has compromised that too, the result is the same. There is no perfect solution to this problem, even if the web app requires on-site in-person registration (i.e. con man, fake ids, etc.)


What happens when the wrong key(3rd parameter) is used in openssl_decrypt() in PHP? I'm using

openssl_decrypt($encrypted_content, 'aes-256-cbc', $key, 0, $iv)

I have noticed that when the wrong $key is given, the result is false. php.net says

  Return Values: The decrypted string on success or FALSE on failure.

What does success and failure mean? Is it guaranteed that if the wrong key is provided, the function will always return FALSE?

In other words, is it possible that a wrong key be given, and the result be a wrongly decrypted string?

This is likely because openssl_encrypt uses PKCS7 padding by default.  The FALSE likely occurs when the padding is invalid.

It is possible to get the wrong result of decryption if the padding is kept intact.  You should use an authenticated mode like GCM or append an HMAC.


What are the security implications of adding an Intermediate Certificate into the Trusted Root Store in Windows? I have 2 certificates (one root and one intermediate).
In Windows OS, the Root certificate is in the trusted root store (for current user).
The other intermediate certificate (signed by the root CA), is to be found (under current user also) under the Intermediate CA store.
I am using SSL verification in one of my client applications (Kafka Confluent) and realized the client only enumerates certificates in the root store. Therefore SSL handshake fails (the intermediate CA is needed).
One solution is to import that certificate into the Trusted Root Certificate Authorities. With that solution, SSL verification at client works. However, is there any concern in doing so?
From security point of view does it make a difference if the intermediate CA exists in the Root store vs the Intermediate store on Windows?
UPDATE
If more context is needed as to what exactly I am facing you can check the issue here https://github.com/edenhill/librdkafka/issues/3025

There is no issue with adding an intermediate.
In general it's not needed since a proper certificate chain is included by the server, so having only the roots makes things much simpler.
In a case such as yours (with misbehaving clients or servers) adding the intermediate is a reasonable solution. The intermediate will have a shorter lifetime than the root, and as long as your libraries do proper revocation checks there should be no issues (but that applies regardless). It's just a bit tedious and manual.


WiFi Hotspot's Evil Twin So an Evil Twin Wifi hotspot is a hotspot with the same SSID and/or same MAC that when the victim auto-connect to this hotspot, all traffic go through this evil twin and thus the information transferred will not be secured. An evil twin requires the knowing of the password of the original hotspot. However, what if a person created one with the wrong password?

This is my theory. The victim might auto-connect to this evil hotspot, and the person logs every attempt. If the evil hotspot has a closer proximity than the original one, the victim is almost 100% will first attempt to connect to the fake one. Since the attempt is logged, the password of the original one could be acquired through this method.

I tried setting up two hotspot with two different MAC but same SSID. I first connect my device to the hotspot A, then I turn off the hotspot A, and turn on hotspot B. The device automatically connects to it. It seems the device does not care what the original MAC address is. Both Android and iOS behave the same.

This seems to post a security threat, however I only tested the auto-connect part. Will the device actually send the stored password to the fake hotspot if it has the same SSID and encryption method? Does this actually work? What can I do to prevent this from happening?

For WPA, The authentication process is known as a four-way handshake.  It's a bit complex to describe but in short, the access point will know that there was an unsuccessful attempt to connect, but it will not know what key was actually supplied.  Fortunately, this would mean that the bogus wifi ap will not be able to figure out the key to the "real" ap.

  Both WPA2-PSK and WPA2-EAP result in a Pairwise Master Key (PMK) known
  to both the supplicant (client) and the authenticator (AP). (In PSK
  the PMK is derived directly from the password, whereas in EAP it is a
  result of the authentication process.) The four-way WPA2 handshake
  essentially makes the supplicant and authenticator prove to each other
  that they both know the PMK, and creates the temporal keys used to
  actually secure network data.

  Capturing the four-way handshake will not divulge the PMK or PSK
  (since capturing the handshake is trivial over wireless this would be
  a major vulnerability). The PMK isn't even sent during the handshake,
  instead it is used to calculate a Message Integrity Check (MIC). You
  basically need to perform a dictionary or bruteforce attack on the
  handshake until you find a password which results in the same MIC as
  in the packets.

Source: Four-way Handshake in WPA-Personal (WPA-PSK)

So you would be able to capture a "message integrity check," but you would have to perform a brute force on this MIC to figure out the password.  So in a way, yes, you CAN capture something similar to a hash, but it's still not very useful.  Plus, there is no need to set up an "evil twin" ap to capture a 4-way handshake; you can just sniff the packets out of the air.


Is encrypted cookie without authentication secure enough? I have some sensitive data in the cookie, e.g. it contains the user id that is later on used to execute the query and we trust the cookie because it is encrypted. All communication happens only on https. Is it secure enough with just encryption, or I need to make sure that the cookie authenticity is maintained by e.g. adding MAC, signature or using authenticated encryption?

Yes you need a MAC in order to ensure the user hasn't manipulated the value to something else which is a valid user id once decrypted.

Also, rather than MAC <userid> you should add some context around it, and then mac that.

e.g. userid=<userid>

This will prevent a substitution attack elsewhere on your site with data that has been MAC'd. For example, if there's a page on your site that an attacker needs a MAC'd 100 to pass to it. e.g.

example.com/view_order?order_id=100&mac=****

The attacker does not know the MAC to input. However, the user can create users and their recently created user has user ID 90. The attacker simply creates 10 more users and has a look at the created cookie. As this will contain the MAC for the number 100, they can then substitute in the value to their URL request above. This is why context matters when creating MACs.

Additionally, you should ideally include an expiry date on such data to prevent replay attacks at a later time.

e.g. you should mac userid=<userid>&expiry=20160203120000


Do URLs used in JavaScript AJAX GET calls need to be sanitized through Apache when there is no server side scripting or database involved? I am aware that any data coming into a server from a client should be handled safely (as in sanitized, whitelisted, etc.) but I had slapped together a very simple system that pulled file contents getting the file name from the query string all on the client side in JavaScript so that the processing of the query string is actually done client side instead of server side.

Essentially what I have at the moment is this:

    function loadPage(){
        var urlParams = new URLSearchParams(window.location.search);
        var page = urlParams.get('page');

        if(page == ''   ||   page == null){
            page = 'home';
        }

        var jFile = 'assets/pages/' + encodeURIComponent(page) + '.js';
        if(fileExists(jFile)){
            if(fileExists(jFile)){
                $.getScript(jFile, function loadReturn(data){
                    loadComplete();
                });
            }
        else{
            console.log('404');
        }
    }

    function fileExists(file) {
        var xhr = new XMLHttpRequest();
        xhr.open('HEAD', file, false);
        xhr.send();

        if (xhr.status == "404") {
            return false;
        } else {
            return true;
        }
    }

I understand the concern/risk on server side with things like PHP especially when dealing with databases so not sanitizing this seems like a bad idea, but on the other end I feel like if this was a security risk, anyone could just make the simple call anyways in their JavaScript console to whatever file they would try and exploit with this.

As far as the why, my goal was to make an extremely lightweight CMS of sorts and if this is just a terrible idea, security-wise I can build out a more complex system but if that is the case, I would be interested in the how/why it is a bad idea as well as possibly any client side solutions. The preference would be to not have any server side scripting on this.

Validation / sanitizing is done on server only. In your example there is no server side code.
If your client loads files that should be available to everyone without any restriction, then there is no need on server to check anything. I.e. you don't have to do anything on the server.
"anyone could just make the simple call anyways" - this is wrong statement. If some resources should only be available to particular users (e.g. web access to emails should provide only emails of logged in user and not of other users), you will probably use some query to find corresponding data in the database. If you don't sanitize your query, you will allow SQL injection and unpredictable behaviour of your application: unpredictable uncontrolled modification of data, uncontrolled access of user to the data of another user.


Is the same key used for Authorization and Encryption? (SSH Tunnel) I am a bit confused on how SSH encryption works.

From reading this question, I see you can use a private key to authenticate with the -i flag.

I also know think that SSH encrypts data using private and public keys.

I am creating an application that will setup and SSH Tunnel and SOCKS5 Proxy for clients. Authentication occurs by using the -i and specifying an included private key.  The idea of this is to ensure that all traffic is encrypted.

I am am afraid that by all clients having the same private key they may be able to decrypt traffic from other clients so my question is the following:

Client A: ssh user@sshtunnel.com -D 5464 -I /path/to/the/private.key -N

Client A: Makes request to http:// unsecured.com with POST data containing Username and Password

Attacker B: Obtains /path/to/the/private.key

In this scenario could Attacker B decrypt the SSH traffic from Client A and view the Username and password in plaintext?

TL;DR: In SSH your private key is not used for encryption at all, it's only used to prove who you are. Each new connection to the server will establish a different encryption session key.

Here are some good primers on how the SSH handshake works:

Understanding the SSH Encryption and Connection Process
How does SSH Work

  I also know think that SSH encrypts data using private and public keys.

Actually, the public and private key are only used for the authentication part of the SSH handshake, not for the encryption part. From those articles, the SSH handshake comes in two steps:

Set up encryption: Use Diffie-Hellman to establish a shared encryption key that both the client and server know, but someone eavesdropping can't know.
Authentication: both client and server use their public keys and private keys to prove that they are who they say they are.

  Authentication occurs by using the -i and specifying an included private key. The idea of this is to ensure that all traffic is encrypted.

How did you jump from authentication to encryption? Your traffic will be encrypted even if you use password-based authentication because authentication and encryption are unrelated parts of the SSH handshake.

  I am am afraid that by all clients having the same private key they may be able to decrypt traffic from other clients

Each new connection to the server will establish a different session key using the Diffie-Hellman key exchange method. This is independent of your private key. To the best of my knowledge, each session is totally isolated from the others, even if they are for the same user or use the same private key.


What is this hashing algorithm? I need to authenticate against another programs user credentials to allow access to a second tie-in system. I am having trouble figuring out what hashing algorithm is being used by the first program in order to create a connection to it. I have the following hashes from throwing around test passwords.

HASH                           | PLAIN TEXT
F3d2427323a202034686f736973616 | password
F2c2737616d6f7270686f736973616 | abc

I do know that the passwords are not case sensative, which likely means that the first program is converting the plain text to all upper or all lower case.

Can anyone identify these hashes?

This is not one of the standard cryptographic hash functions. There is also some sort of encoding which includes things other than the hash, because both strings end with the same sequence '686f736973616'.

In fact it looks to partially be the direct encoding of ASCII strings, possibly truncated. Ignoring the leading 'F' and the final '6' (are you sure the values are not truncated when you display them ?), your examples map to =$'2:  4hosisa and ,'7amorphosisa respectively, which look suspiciously non-random to me.

Looking at it more closely, I notice that this so-called "hash" is just a byte-wise XOR. Namely, it seems to go thus:

Convert the password to lowercase.
Pad the password to 14 characters by appending spaces.
XOR the encoding of the password with the encoding of: metamorphosisa
XOR each resulting byte with 0x20 (the ASCII encoding of a space).
Convert the result into hexadecimal.
Put a 'F' at the beginning and a '6' at the end.

I.e. not a hash at all, rather one of the weakest forms of homemade encryption.


Security implications of Cloudflare's SSL Full mode (not Strict) Cloudflare enables several options regarding the communication between its servers and our own.
"SSL Full" means Cloudflare encrypts the traffic but doesn't check the validity of our servers' certificate.
"SSL Full (Strict)" means Cloudflare encrypts the traffic and checks the validity of our servers' certificate.
I am wondering what the security risks are of using "SSL Full".
I understand that theoretically the risk is that someone could pose as us to Cloudflare. I guess this would require that when Cloudflare's servers try to resolve the IP address of our server, they would be misled towards this malicious server. Or that someone on the way between Cloudflare and our server would pose as us, in a Man in the Middle pattern.
How likely is that? Is it even possible?
Cloudflare isn't explicit at all as to whether this option is acceptable in a production setting.

Issues with SSL Full (not strict)

MITM: you can easily put the whole Internet into the scope, and at least your infrastructure provider. With SSL Full you have the following scheme in place:
[user] --- TLS ---> [CloudFlare] --- TLS (self-signed) --> [origin]

On the right side, a self-signed certificate can be used (even not a valid one, compromised, any). And let's zoom in to the right part between [CloudFlare] and your [origin]:
 [CloudFlare] -> Routers -> ISP -> Server provider -> Routers -> [origin]

Because CloudFlare trusts to ANY certificate at the right side in this case, then a malicious actor at any intermediate node between CloudFlare and the origin can put the certificate and intercept the traffic, and neither CloudFlare nor your origin can identify the leak. You don't know whether it happens until you find yourself in the news.
See more additional notes below.

Internal threat and Access control: your engineers can mess up with certificates, replace them, use compromised ones, and redirect traffic through their own MITM server. The strict option narrows down the threat to the people with access to a domain controller who can issue a proper TLS certificate on your origins.

What option to choose?
The thing is that it's up to your risk acceptance whether you're ready to keep the connection of this kind of security level in place. Most likely we trust to CloudFlare's part of the network, and to server provider's part of the network  (infra), and it basically means that you can keep SSL Full for a while. And I would personally recommend to start from SSL Full, but to plan to implement SSL Full (Strict) as soon as possible.
And forget about MITM for a moment: access control issue (internal threat) is a rather severe risk to not get considered.
Likelihood of MITM
I don't know for sure, but the important thing is that you have to apply the likelihood on the sensitivity of the traffic flowing through the channel. E.g. if the origin receives the PII, payments, and so on, you will get the higher severity of any possible breach. If to imagine that you send some trash just for fun through the channel, then you can drop the security of the channel to HTTP and don't bother.
Your ideal security strategy

Step 1: SSL Full
Step 2: SSL Full (strict)
Step 3: SSL Full (strict) with CloudFlare's CA.

Step 3 means to use CloudFlare's CA to issue certificates for your origin servers: users can connect to the CloudFlare's front-end, but users won't be able to connect directly to the back-end without a TLS handshake error, as browsers don't trust to CloudFlare's Root CA. You would also need to whitelist CloudFlare via iptables.
Again, it's up to you whether to use or not any of the options, it boils down to security and risk assessment of your system.


Difference between DNS spoofing and phishing I am writing a bachelor thesis and I am having a hard time figuring out the difference between phishing and DNS spoofing. From what I understand, DNS spoofing is a way to achieve a succesfull phishing of somebody's user name and passwords (or other credentials).

Do I understand it correctly ?

Phishing is mostly a social attack, i.e. you might setup up a site which looks like a trusted one (i.e. copy of Paypal), give it a hostname which might fool the user (e.g. https-paypal.encrypted.whatever) so that the URL and links look trustable, put it together with some story ("detected hacking attempt, needs verification..") in a mail and wait for gullible users. You might use it to get credentials, infect the user with malware etc.

DNS spoofing instead is a technical attack, where the attacker tries to respond to a DNS query ("get me the IP address for paypal.com") with their own (wrong) answer and thus direct the user to the attackers site instead of the requested site.

Since DNS spoofing is a technical attack you can protect against it with technical solutions, like DNSSec. Using https also protects against DNS spoofing since the attacker does not has the certificate for the requested name. None of these things help against pishing, since this attack is not against a technical based trust system but against a social trust system. Against phishing, only awareness helps, and if you are lucky the phishing attack was not targeted against you, but against lots of users. In which case browsers often have the relevant sites in a blacklist already.


Can I generate a double cookie CSRF token on the client with JavaScript? Are there any problems with creating the CSRF token with JavaScript just before submitting the form? Example:

var csrf_token = Math.random();

// Write csrf token to cookie.

// Add csrf token to the form being submitted.

// Submit form.

// Verify cookie csrf to form csrf on the server.

// When request is done; remove the cookie.

// Rinse and repeat.

I understand this is vulnerable to XSS but the XSS could just submit the form with custom values so having XSS is worse.

I would not recommend this. For the token to offer any protection, it must be unpredictable. Math.random() is not cryptographically secure - there is no guarantee that an attacker can not generate loads of random values, detect the pattern, and then deduce previous values thereby finding the value of the secret token. This is called "cross domain Math.random() prediction", and you can read more about it here and here.

I think (not sure, though) that most modern browsers protect against this in practice, but that is an implementation detail I would not bet the security of my application on. Actually, MDN warns against it:

  Math.random() does not provide cryptographically secure random numbers. Do not use them for anything related to security. Use the Web Crypto API instead, and more precisely the window.crypto.getRandomValues() method.

So can you just switch to getRandomValues()? Only if you are fine with 80% browser support.

Before doing this, ask yourself why you can't just generate the token on the server instead. If you go for the client approach anyway, at least avoid these two pitfalls:

Make sure that no token in the form and no token in the cookie does not pass! A naive equality check could let that pass, since both are an empty string, but that would open up a vulnerability.
There must be no URL that loads a page and automatically submits a form, adding the token in the process. Such an URL could be abused.


Man in the middle with certificate signed by known CA and DNS spoofing can work? Assuming that I have a certificate for my local webserver signed by a well known CA like Verisign (so it will be trusted by browsers), and I'm able to DNS poisoning in Man-in-the-Middle to redirect a user who wants to go to google.com on my local webserver who has the same hostname google.com, what will be the consequences?

Is there a risk? If so, how to prevent it?

I don't know why SSL pinning is only used for mobile app. If the attack above works, so SSL pinning can be a prevention. But it's not used on computer...

In order for that to succeed the server's hostname would have to match the certificate name. That means you would have to either get a CA to issue a cert as google.com (not likely to happen) or you would have to get a root cert from a CA you control and install that on the user's computer as a trusted CA certificate.

Even then, many big web sites use public key pinning which forces the browser to only accept a specific cert until a pre-stated expiration date. Both Chromium and Firefox do support pinning.


Are Flash .SWF apps (browser) a security threat? Are Flash (.swf components on webpages) a security threat?

Flash banners (without any user interaction, not asking for any permission... just like static .swf add-slideshow)?
Flash apps, that require simple user action, asking e.g. to use the Microphone. (i dont care of privacy, but ability to hack whole system in case of clicking YES)
Flash apps, that are complete/heavy web-applications, like a web-based "image editor" or etc.

Also see this similar question about Java.

If 'banners' means simply asking for user permission before executing the plugin, then the answer is yes - on an unpatched vulnerable system. Eg - CVE-2015-5122
Yes. Why not? I can record with your mic, take pictures of you and upload it for blackmail value or use it in a bunch of other nasty ways. Even if you don't care about someone being able to record you or photograph you, think about the possibilities of using this in combination with a flash 0day or even a vulnerability left unpatched by you, the user.
If you consider (1) and (2) security flaws, then this is a possible attack vector. Just apply the same exploitation concepts here. There's no difference.

Java exploitation: As @Anders said, this answer has been moved to that link

tl;dr: Yes. All of these are possible attack vectors, either in combination with SE or through exploitation of unpatched systems or using private exploits.


Creation and deployment of self-signed certificates for a two-machine scenario Let us assume that I have two computers:

client
server

Now, in the server computer, I set up a legacy ASMX web service which will going to be used by the client. Before the client can connect to to the web service, however, I want him to be authenticated using digital certificates.

So I do the following:

Create a self-signed certificate on the server (certification authority)
Install the certificate in the Trusted Root Certification Authorities on the server (through MMC).
Install the certificate in the Trusted Root Certification Authorities on the client (through MMC).
Generate a certificate (based on the self-signed certificate) for the web service application and install it in the Personal certificates section (through MMC) on the server machine.
Generate a certificate (based on the self-signed certificate) for the client and install it in the Personal certificates section (through MMC) on the client machine.
When the client communicates with the server using the web service, the two entities exchange certificates for authentication.

Is the procedure highlighted above correct? I am asking this because I found a lot of articles overloaded with information and which fail to describe the basics in a simple manner.

Your principles are correct, but the particulars can be a devil to set right.

Indeed, the general schema is that:

The client needs to validate the certificate from the server, i.e. verify that the certificate has been issued (signed) by a trusted CA, and that the alleged server certificate contains the name of the server.
Similarly, the server needs to validate the certificate from the client, i.e. verify that the certificate has been issued (signed) by a trusted CA, and then obtain the "client name" from the certificate.

So both client and server need to trust some root CA certificate -- not necessarily the same (but it does not hurt that they both trust the same). Moreover, both client and server can be a bit picky about what they find in their own certificate, and in the certificate from the peer. The server certificate will have to contain the server name as prescribed by RFC 2818 (section 3.1). If you include the Extended Key Usage extension, then IIS and Internet Explorer will tend to require the "server authentication" key usage (1.3.6.1.5.5.7.3.1). For the client certificate, IE and IIS will again want to see a specific key usage, namely "client authentication" (1.3.6.1.5.5.7.3.2).

The server (IIS) must also make something out of what it finds in the client certificate. There are several methods. "Account mapping" is about associating the client certificate with a client account, accounts being the notion of identity which prevails within a Windows operating system. If an Active Directory domain is in force, the mapping can be direct (the certificate is mapped to the account which, on the AD server, contains a copy of the certificate) or indirect (the certificate contains a copy of the User Principal Name of the account, in its Subject Alt Name extension). Non-mapped authentication is possible, too, in which case the application is responsible for making sense of the certificate.

Certificate revocation can be a problem, too. Conceptually, a CA who has issued a certificate can "express remorse", and announce to the World at large that a given certificate, though seemingly all signed and signed and valid, must nonetheless be rejected. This supports emergency situations such as a stolen private key. This announcement uses a Certificate Revocation List, a short-lived object signed by the CA. Both the server and the client may want to obtain a fresh CRL which covers the certificate they are trying to validate. Your homemade PKI does not publish CRL regularly, so if the client or the server gets into its head to verify revocation status, things will fail.

Whether IIS and/or IE will engage into revocation check depends on what they find in the certificates, but that's not documented with the utmost clarity. IIS can be configured to disregard revocation checks. For Internet Explorer, this can also be done, apparently on a zone basis (IE categorizes servers in "zones", such as "local intranet" or "Internet", and can apply different security settings for each zone, one of which being "enforce revocation status check").

This blog post seems to cover your situation. I suggest you follow its indications. Don't fiddle with revocation unless you get some error messages stating that some revocation status check could not be obtained, in which case you may have to build a CRL and push it on both client and server (with mmc.exe), or deactivate revocation checks (as indicated above).


Is it safe to keep decrypted data in memory? Due to new laws in my country, any personal information must to be stored encrypted in the database.
So, to be able to perform querys over this data I was thinking to keep an in-memory copy of these tables with decrypted data.
For example, to get everyone that are more than 18 years old will be very hard if the DateOfBirth column is encrypted.
I'm using aspnet.core on a linux machine.

The short answer is: Just don't.
The long answer is: It depends on the rest of the system.
As ram0nvaldez said, you have to decrypt the data to work with it.  Some level of decrypted in-memory is necessary.  But!
Are you storing your cached DoB data in a Redis cache?  Redis writes its cache data out to disk on a regular basis to facilitate fast restarts.  That would need to be encrypted, too.
Is swap encrypted?  If it's not, then any of your cache that gets swapped may break compliance.  At the very least, it opens the door to a lot of explaining why it's not a problem.
Not to mention storing all that cache creates new problems for your app: memory pressure, cache coherence, and scalability among them.  New devs on the project need to be told to use the cache-search object, and not instinctively write direct database queries.  Is it just DoB?  How many other columns in other tables need the same?  Really, you're better off finding a way to make the database do the work.
AES-NI instructions in modern CPUs make short work of encrypting and decrypting data.  Try to copy a file over the network with scp -o Compression=no and you'll likely see it copy over at wire speed, thanks to AES-NI.  Encryption simply isn't the bottleneck it used to be.  The database can use those instructions to decrypt the index and the data page-by-page, not row-by-row.
If the application has to fetch and decrypt each and every row to find all the records with age >= 18, then you may as well cache it as you'll be pulling the whole table into memory with every query anyway.
Leveraging the encryption features of modern databases makes it easier to be compliant with less overhead.


Hash function with configurable length Here's a short question: does a hash function with configurable length exist?
And if not, why not? Would it be a problem?

I think this question was already discussed here and the answer was like that it is actually possible, as examples like Skein and Keccak show. They participated at SHA3-Competition in 2012, particularly the so called NIST hash function competition. Skimming the functionality of the winner of this competition, the currently representative of the SHA-3 algorithm, could help you to comprehend that there is at least one efficient example for an algorithm, which in a sense allows hash length manipulation.
Keccak
So for example the Hash function Keccak is, as Tom Leek told already, a so called Sponge-Hash and gives the opportunity to manipulate the length of the resulting Hash by default. Interesting for you to see are, all in all, the following two parameters Keccak is taking:
Parameter: L
If we just take exemplarily a quick look at its functionality we will see, that Keccak works with a state vector b which is initialized with 0 , containing 25 words  w and each of this words consist of w = 2 ^ L  Bits. Consequential to this, the state vector has a length of b = 25 * w .
Parameter: n
n represents the bit length of the desired hash value. In the version that was handed in for the competition, there was L = 6 , what implies that the length of the actual hash value will be between 224 and 512 Bits. But as you can see the resulting length of the hash is variable , depending on the input parameters we discussed so far. The accosted length of the hash, in the range between 224 and 512 Bits, is just customary as you could change the L parameter to manipulate the length.
Of course the Keccak, respectively since for now two years the officially SHA-3-Algorithm, does not end here and this was not a very sophisticated description. Actually furthermore there will be gradually XOR-Encryption, which is comparable to a classical block cipher. But for further details you could take a look at the wikipedia article here. I think going into details related to technically sophistrys would be more as needed to answer your question.
I just wanted to exemplary knock up the initialization of the needed parameters to show you that there are ways of manipulating the resulting hash length.


Multiple encryption subkeys on hardware smart cards I've created a PGP key set which consists of the following:

A master RSA key with only signing capabilities, stored offline.

Multiple OpenPGP cards, each with three RSA keys:

An encryption key
A signing key
An authentication key for SSH

My reasoning behind making it this way is so that if a single hardware card gets stolen, I can revoke all of its certificates in a way that doesn't "damage" my remaining infrastructure. (Except, of course, that I now need to re-encrypt my encrypted data to exclude this key and that I need to recreate long-lasting signatures with a different signature subkey, but these things don't damage my identity: they're just really inconvenient.)

Granted, multiple encryption keys is not the best idea, but I'm particularly concerned with encrypting and decrypting backup files and not emails as much. I'm not sure if there's a way for an emailing user to have their emails encrypted to all three of my encryption keys at once, but it's not the end of the world (though really inconvenient) if it's only encrypted to one encryption key.

The problem I'm currently facing involves trying to setup a LUKS boot with a GPG encrypted keyfile. My current setup works, but it only allows decryption with one of the cards. My public and secret keyrings look fine, the secret keyring contains stubs for all of the smart cards. If I try decrypting with another one of the cards, it chokes and fails, prompting me to insert the "right" card.

My key file is encrypted like this:

gpg --output /keyfile.gpg --encrypt --recipient $MASTER_KEY_ID \
    --encrypt-to $ENC_SUBKEY_1! --encrypt-to $ENC_SUBKEY_2! \
    --encrypt-to $ENC_SUBKEY_3!

Note how I'm using ! to force it to encrypt for these subkeys specifically. On boot with cryptsetup, I see the following message if I have a different card inserted:

gpg: error reading application data
gpg: decryption failed: secret key not available
cryptsetup: cryptsetup failed, bad password or options?

If I use the card containing $ENC_SUBKEY_1, decryption works and the OS boots.

My key script is fairly close to the one provided by cryptsetup:

if ! /lib/cryptsetup/askpass "Enter passphrase for key $1: " \
    /usr/bin/gpg -q --batch --no-random-seed-file --homedir /lib/cryptsetup/gpg \
        --ignore-valid-from --ignore-time-conflict --passphrase-fd 0 --decrypt $1; then
    return 1
fi

return 0

If I do the same kind of encryption on a file in my running operating system, I'll get an interesting output when I try decrypting with a key other than the first one passed as --encrypt-to:

Please remove the current card and insert the one with serial number:
    XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
Hit return when ready or enter 'c' to cancel

If I hit c up to twice, it'll eventually "find" the right key and decrypt the file. Presumably because it's in --batch mode on boot, it won't prompt and will instead just fail.

Is there a way to bypass this problem? Is there a way I can tell GPG to just keep trying until nothing at all works? ie: key for card 1 can decrypt; card 1 not present; key for card 2 can decrypt; card not present; key for card 3 can decrypt; card present; decrypt.

The problem is, that "stub" keys for all of the three cards are stored in your computer, and GnuPG is trying all of them.

Sadly, I'm not aware of an option to define a fixed decryption subkey, skimming through GnuPG's man page also did not reveal any.

As far as I see, the only option you have would be to remove all but the currently used encryption subkey from the keychain, and switching keychains if necessary. Be aware that before GnuPG 2.1, merging subkeys is a pain, so be sure to keep a keyring around containing all subkeys.


Risks of sharing multiple, old TOTP codes? What are the risks (if any) of sharing the TOTP codes?

I'm referring to the six-digit codes generated by Google Authenticator and the like. By "sharing old tokens" I'm thinking of posting online a list of, say, 10 consecutive codes I got (and the times I got them), or letting someone who's with me see my phone in real-time, but being sure they are not using them to log in as myself into any system.

I'm thinking about the possibilities of deriving? the original secret seed, or thinks like that - and not thinking about people letting others know my code without me noticing it so they impersonate me.

Is there any other risk I'm not thinking about?

I think the general answer is "It should be ok, but TOTP wasn't designed for this so you won't get any guarantees".

If we dive into how TOTP works (general description at wikipedia, full spec in RFC 6238), the TOTP value is computed as (example, simplified)

SHA2_HMAC( secret_seed, system_time_rounded_to_30s )

Generally login servers will check all time values within a +/- 5 minute window in case the device's system clock is off (which is needed for hardware TOTP tokens like those pictured below that have no way to sync).

So your TOTP values may actually still be valid for ~ 5 minutes. Also, as @AndrolGenhald points out, they may become valid again if the server's system clock gets set back.

This question does a good job of addressing the "can the original seed be derived" part of your question, the general answer is "it shouldn't be possible as long as the shared secret_seed is 32 bytes or more".

It's also possible that the website's implementation has some edge-cases that break this general advice. For example, some websites issue account recovery codes that look like TOTP codes, but I don't know if they're actually related to your TOTP seed or not.

How many known time/result combinations does it take to guess a HOTP/TOTP secret?

Bottom line: I can't think of any attack from posting a list of expired OTP codes, but I also can't guarantee that it's safe.

If you're at a coffee shop, probably best to be careful about who can shoulder-surf your TOTP codes. If you want to post old codes online, probably best to register a new code generator and unlink the other one from your account before posting.


How can I implement authentication in my proxy server? I have a proxy server, it will have a captive portal page. Users will be required to sign in before gaining access to the internet.

So far I am aware of IP and/or MAC address based authentication.

Is it possible to use HTTP cookies to implement authentication? (Maybe third party cookies?) How does websense do it? (see cookie authentication)

If HTTP cookies are not usable for proxy authentication, is MAC address authentication  the industry standard for this thing?

Typically, the standard way to implement proxy authentication is, surprisingly, Proxy Authentication.
This is a set of matching response and request headers, that together implement authentication that is required between the user and the proxy.

This is commonly used with transparent proxies, and is well supported in both browsers and proxies. Some proxies do implement this differently (e.g. how the credentials are verified), but in most cases this is the much preferred solution. There are very few drawbacks to this solution, and alternate solutions that break standard HTTP, such as BlueCoat, have quite a few issues.

Now, you do mention that your proxy will be implementing a captive portal, but you did not mention why. If it is just to implement the authentication form, thinking that there is no built-in solution, I would recommend you change your solution, use standard proxies, and just define required authentication. Building your own captive portal is just way too tricky, and will likely open you up to a whole slew of vulnerabilities (from experience).
If there is some other reason to build the captive portal - random signups, payment options, crazy fun, etc - perhaps elaborate, and we can deal with them. Otherwise it does look like an XY problem (where you assume a solution and ask about that, instead of asking about your actual problem...)


Signing (HMAC) cookie identifier Related to this other question about sharing the secret to sign the cookies, my question is more trivial: how really secure is to sign a simple cookie identifier?

In example, expressjs#session library requires a secret, but also says at the begining of the docs:

  Session data is not saved in the cookie itself, just the session ID. Session data is stored server-side.

But I don't see any benefit to create an HMAC of an identifier, because this value will be anyway a bearer token for server state.

I think that an HMAC provides little added security if the session ID is something that is hard to guess. For example, a long secure PRNG. But if the session ID is simple to guess then there is the risk of session hijacking.

As the expressjs framework allows you to provide a session ID creation function that returns IDs with unknown security properties, an HMAC seems like a good strategy.

The default uses the uid2 library which looks like (I'm not a NodeJS user so I'm not certain) a secure PRNG (see source code). An HMAC seems of less value in this case.


Block hex encoded requests using fail2ban I have new web server running nginx.  The default server is receiving 10K+ requests every day from Russian bots.  They are clearly probing for something, but it's hard to say what since the requests are partially hex encoded.  I have tried decoding them, but still couldn't tell what their aim is.  Here are some examples:

  W\xF1p\x8B4\x1D\xFB\x06\xD9\xBF\x82\x87\xE8\xC8\xA2\x98\x9Boj\xB6`6\x15\x8B\x1Ab\x17\x92\xC1\x12\xC9\xCB{AW\x14\xCB\x14\xDD\xC9\x9F

  Q\xA3q\xD1\x9E\x93\x95\xD8\xBD_|>\x87z\x95\x0Bz$

  \xF3\xFA\xD2s\xB8$\x11(q\xDBk\x9E\xEBn\x22\x22\xE4N\x0B\xFC\xB2\xE6\xD2\x9F\x81\xF4\xC2>dq%\x9F\xD8u)\xAE\x06{

The server returns 400 for all these requests.  Regardless, I would like to block these bots from making these requests since I don't want them to succeed at whatever it is they're trying to do.

I use fail2ban but it isn't configured to stop these.  Should I set-up a special filter to find these in the logs?  The only consistency that I can see is they all have "\x##" where ## is a hex code.  However, I don't want to block any legitimate requests, so the filter needs to target these bot requests only.

Any ideas on how to do this?

Fail2ban is nice to block attacks that generate a expected output, like login attemps or similar stuff. In your case, you are receiving requests with shellcode. That shellcodes are some kind of payload to try injections or similar (sqli, command injections, etc). So to protect to these kinds of attack what you need is a WAF (Web Application Firewall).


I visited a malicious link and I am paranoid I am a Mac User and while I was on youtube, I clicked on a url www.giftforfans .us
I don't know what I was thinking but I got phished pretty hard...
Now I am a bit paranoid and I am wondering if people's computer can get infected simply by just visiting this website...
I don't know what the website does but I don't think it has downloaded anything on my computer on my download folder... Is it possible that this website somehow got my userID and Password of my email credential?
Thanks for all the help

I don't think you have much reason to be paranoid.

Browsers are one of the best sandbox out there. Which means that anything that happens in your browser doesn't affect the rest of your computer. So theoretically, you could visit malicious link all day long and it would have no impact on your computer. That is, unless the attacker found a zero day exploit in your browser. So, not it probably didn't install anything on your computer. The nice thing about surfing the web is that it's very hard to infect your computer unless you deliberately accept to download/execute something.

About stealing your userID and Password, it is also unlikely. Unless you wrote them on this site yourself. Each browser has what we call the same origin policy. This policy restricts what one page can see. So, this malicious site cannot access the information that you entered on other site.


Does appending a hash of a timestamp to a randomly generated string make it less secure? I have the following code for generating session tokens:

binascii.hexlify(os.urandom(16)) + hashlib.md5(str(time.time())).hexdigest()

which converts the randomly generated 16 bytes suitable for use to hex format and appends a hash of the current timestamp.

Does appending the timestamp make it any less secure (against say, brute force attacks) than having just the randomly generated bytes?

Adding the timestamp or even some constant string does not make the preceding random string less predictable by itself. But it might be if the attacker gets side information like the total length of the compressed string because in this case the less random part can be used to infer information about the random part. See for example the CRIME and
BREACH attacks.


Sniff packets with wireshark on localhost I have a webserver in my windows machine running Apache(XAMPP).
I have created an Android application that connect to my webserver at localhost.
How can I capture the data with wireshark on localhost?

That is a common enough problem. Unfortunately, there is no universal solution for this under Windows.

You can work around it by binding your server to your local IP address instead of the loopback address (localhost). You will need to connect your android device to the network and have it connect to this address as well. After this, you should be able to intercept your HTTP traffic with Wireshark.

Another option is to enable full HTTP traffic logging on your server. Apache has mod_dumpio that will do that (although I have no idea if it's available under Windows).


How are HSMs used in payment processing on the server? I came to know recently that HSMs are used in credit card processing on the server side but since I don't work in that space and stumped as to why its needed.

I can see it used in an ATM machine  - to encrypt data to be sent to the server for verification.

But once its already inside the firewall would I not just query the card details from the DB, decrypt it and then compare with what I got over the wire and then send it over to my card processor.  Why would I need a HSM in this path?

EDIT: I understand how HSMs typically work. What I don't know is how they are used in payment processing. Can some one throw some light on that?

@thomas-pornin and @PwdRsch have explained what an HSM can do, but you've clarified that you want to know what they're used for in payment processing.  The short version is - they are used to strengthen the encryption protections that processors use.

Let's assume you mean credit card processors.  The PCI HSM Security Requirements suggests a number of places HSM would be applicable:

PIN Processing
3-D Secure
Card Verification
Card Production and Personalization
EFTPOS
ATM Interchange
Cash Card Reloading
Data Integrity
Chip Card Transaction Processing

Some simple uses can be inferred by the PCI Data Security Standard requirements, which credit card processors must be compliant with.  DSS 2.0 Requirement 4 says that the processor must

  use strong cryptography and security protocols to safeguard sensitive cardholder data during transmission over open, public networks.

So, DSS says web servers need HTTPS.  An HSM can store the private key to make that setup more secure.  IPSec might be a way to meet Requirement 4; it can also benefit from HSM.

DSS Requirement 3.4 says that

  Render PAN unreadable anywhere it is stored... [such as with] Strong cryptography with associated key-management processes and procedures

So, for example, credit card numbers stored to a database must be encrypted.  An HSM can be used to support database encryption.

Payment processors need encryption.  HSMs make encryption... better.


how much traffic can a packet filtering firewall _ implemented with iptables _can handle? I am trying to build a packet filtering firewall, that supposed to serve in a network consisting of almost 100 host.

Can a firewall build with iptables do such a task?

What is the best linux distributions to build such a firewall on?

Many companies use IPTables as the primary firewall for networks with thousands of hosts. Likewise many commercial firewall products are based on IPTables so yes this is not only acceptable but quite common.

You may need to be consider the bandwidth involved and the number of packets per second compared to the hardware you are using in extreme situations or have a very high-speed connection to the Internet but if your outgoing bandwidth is 20% less than the bandwidth of the ethernet card you are probably using it's unlikely to be an issue for most modern web or office traffic.

Using a modern distro that you feel comfortable administrating is probably the most important issue for distribution source. IPTables is not skewed heavily toward any given distro. A better question to ask here may be which distro is going to be easier for you to secure especially since you are using it as a firewall.

Consider if you need to create separate secured segments when architecting your firewall solution. It's easy to have multiple interfaces on an IPTables-based firewall and more isolation between infected desktops and servers can be really helpful.

Finally do consider using IPTables on all of your linux hosts. The concept of Zero Trust Firewalling, where each system is hardened and has it's own firewall rules tightly configured is much more secure than the traditional flat network design.

Don't rule out projects like PfSense https://pfsense.org/

I like to build mine from scratch but you may find a lot of features in a package like this helpful.

You may also want to look into projects like fail2ban and possibly mod_security. I could go into hundreds of other security projects but these might be a good starting point.


Is a password-protected stolen laptop safe? Let's assume I have a Windows 10 computer and my login password has an entropy of infinity.
If I did not encrypt my entire hard-drive, does it matter how secure my password is? Is it possible for someone to plug the hard-drive into another computer as an external drive and simply read all its contents?
Thanks

Is a password-protected stolen laptop safe?

No.
The immutable laws of security say:

Law #3: If a bad guy has unrestricted physical access to your computer, it's not your computer anymore.

It doesn't matter if your laptop is password-protected or not. As long as the disk is not encrypted by a state-of-the-art encryption algorithm, anyone can access your data.

If I did not encrypt my entire hard-drive, does it matter how secure my password is?

No. Your data are safe if, and only if, the data are well encrypted. Password protection of an OS usually does not encrypt the disk (except on iOS, as far as i know). Consider using BitLocker (on Windows), FileVault (on macOS), or LUKS (on Linux).

Is it possible for someone to plug the hard-drive into another computer as an external drive and simply read all its contents?

Yes, someone will do exactly this.


Track Mobile Device Within Premises My brother is working as fresher in one IT organisation in network department. His company is building mobile applications so they have more than 100 mobile devices within premises and more than 500 employees.

Every day they are picking devices for their projects and many of them are forgetting to return it back. The network admin has assigned him a duty to collect it from every one before leaving office for the day in the evening. Due to this duty he is always coming late at home. He needs to search devices on each 5 floors and it takes almost 3 to 4 hours.

Is there any technology, app or devices available that can solve this his daily problem. I will suggest it to his Network admin. I have searched many MDM (Good dynamics and others) and device tracker like TrackR Bravo Bravo, ITag smart etc. Please suggest, It can save some ones daily hours and he can spent more time with his family.

Can we identify device location using wi-fi?

It depends on how precise you want to locate them. There is no commercial solution that can do this on premise that I´m aware of(Because GPS etc. suck indoors).

What comes to my mind is triangulating them with several wifi antennas in a selfmade solution. Your brother would have to set up several wifi antennas in the building that are in monitor mode and report to central station. As long as all devices have wifi enabled and you know their MAC Address(or wifi can be turned on remotly by MDM) you can triangulate them

For Example (please forgive me my non existant Paint skills):

You check all your APs in Monitor Mode and the MAC adress of the device you´re looking for is recognized by AP1-3

AP1 gets a damping strenght of -50db
AP2 gets a damping strenght of -40db
AP3 gets a damping strenght of -45db

Now you need a little estimation because the signal strenght depends on things like wall thickness etc but you can take a max and min lenght for any given strenght (+/-3 meter of what you expect for example).
In this example AP1 is in a part of the office with no thik walls, etc. AP2 is in a small office with concrete walls and AP3 is positioned somwhere in the hallway (therefor the variance in min/max distance).

Now you´ve got 3 min/max lines for the given 3 APs and they only overlap in the area marked green which is the location of the device.

I know this approach is far from precise but I think if you script and test everything properly (especially the variance in estimated lenght) this would be able to locate quite precisely.


GPG - limit who can add and remove from pubring I'm working on a project where we use git-secret for hiding information. This is backed by gpg, and adding people to git-secret (http://git-secret.io/) is done by adding a public key to a pubring.gpg. After starting with a clean computer, I had to generate a new key and add it to git secret. Usually someone else does the adding, but I decided to try myself, and to my surprise I was able to both add and remove users to this pubring, without my key being part of it.

Is there a way to limit the access to modifying a pubring, so that only users with their public key inside of it can add or remove keys from the pubring?

The way I understand adding keys to your keyring doesn't allow them to decrypt anything. git secret will only add decryption information for users whom you have added with

git secret tell persons@email.id

(Which might internally be implemented as a keyring, though).
There is still a problem, howewer.
From the docs:

  Note, that it is possible to add yourself to the system without
  decrypting existing files. It will be possible to decrypt them after
  reencrypting them with the new keyring. So, if you don’t want
  unexpected keys added, make sure to configure some server-side
  security policy with the pre-receive hook.

Trying to answer the question from the title:
The gpg keyring is stored in a file and you can probably just use normal access control restrictions on that file.


Wireless MAC Address Filtering - Authentication/Association Can somebody explain to me how a wireless AP denies access to the network if the client does not have the correct MAC Address.

Does it not send a probe response when a client has not got a correct MAC. Or when the client tries to authenticate, it gets denied.

please can you include reading sources as well, if you know of any.

It is really that simple, if the AP has a MAC filter, any device which attempts to authenticate that doesn't have a MAC address on the list will just be denied.
However the problem from a security perspective (which is why this should not be used as a security function) is that it is trivial to spoof a valid MAC address (by sniffing them wirelessly and waiting until the valid user has gone - this is a common technique for avoiding usage costs in airports)
Update to show where MAC address denial happens:

Client --------------Probe-------------> AP
AP -------Probe Response----------> Client
Client ---802.11 Auth Request-----> AP

MAC authentication happens in here. If the client MAC is not on the list the following responses will not get sent:

AP ------802.11 Auth Response---> Client
Client --802.11 Assoc Request----> AP
AP -----802.11 Assoc Respons----> Client

Which is then followed by EAP etc.


Exploiting CSRF on DELETE Request I was testing a site and came across a request with DELETE and I found X-CSRF: parameter was sent to ensure the doc can be deleted by a authorized person but when I removed the entire X-CSRF token and sent a empty parameter, it was accepted and the Doc got deleted.

Is there any possibilities for a exploit ?
Thanks in Advance.

The simplest CSRF vector would look something like this:
<img src="https://example.com?send_money_to=myself@me.com&amount=100000">

Then you just need to get this bit of HTML in front of the victim.  However this will generate a GET request.  If the endpoint uses POST you could try something like (example only - not tested):
<form action="https://example.com?send_money_to=myself@me.com&amount=10000" method="POST" onload="this.submit()">
</form>

Unfortunately that will only get you GET/POST.  To submit a DELETE request you need actual javascript.  In general you could just host code like that on any website anywhere, so you don't need an XSS vulnerability.  CORS would block the javascript on your page from reading the response, but as long as the request is sent it won't matter.  Unfortunately things get more complicated for a DELETE request because it is a non-standard request and triggers additional CORS behavior.
If you try to send a cross-domain DELETE request via Javascript from a cross-domain origin, the browser will first send an OPTIONS request to ask the server if such a thing is allowed.  Therefore, as long as the destination server is properly checking the HTTP verb, it will never accept your request.  The server will respond to the OPTION request, it will not have white-listed the domain your Javascript is hosted on, and a DELETE request will never be sent.  As a result, a CSRF token is not strictly required in this circumstance.  However there are a few things that can change that:

If the server has misconfigured CORS that responds to the browser and allows all domains in the wrong way, your DELETE request will fire anyway
If your javascript runs on the actual domain, then CORS won't happen (but that would be an XSS vulnerability, which beats CSRF anyway)

In short, this would only be vulnerable in the light of additional misconfigurations.  It still isn't a great idea, because someone down the line may decide to convert all DELETE requests into POST requests, and forget to add the CSRF check, but it is probably safe as-is.


Can HMAC leak the password? Imaging the following pseudo-code:

h = hash(sha512)
h.input(password)
h.input(message)
send h, message to client

If the user has the hash and the message, and the only missing variable is the password, then why can't you reverse engineer the password without brute forcing it?  Math has taught me that if you have two out of three variables, then you can always work out the missing one.

What Math has told you is correct if you assume uniqueness and equality. For example, from a = b + c, it follows that b = a - c. Why is that? Addition has an inverse function mapping a pair of integers to a unique integer again. If you think of + as a function with infix notation and two arguments. Think of - as the inverse of that function. Then you would get: a = +(b,c), and hence b = -(a,c).

The same way, you could think of hash as a function with two arguments. And the inverse would be some function hash'. I will discuss the existence of such hash' below. Then, we would get

h = hash(m,p).

However, we would not get m = hash'(h, p).

Why? The simple answer is that there does not exist a unique v such that given h we have that h = hash(v). The pigeonhole principle tells us that there must be collisions for hash (meaning that there must exist some h for which there are v1 and v2 such that hash(v1) = h = hash(v2)). This is because  the length of the images under hash is fixed. The length of the inputs of  hash, however, are not bounded. Therefore there is no function hash' that returns a single value. It would rather return something like a set of values.

Your question is why we cannot find such value(s) by (simply?) reverse engineering hash. The answer to this question lies in the way such hash functions are constructed. Their purpose is to compress and to obfuscate, meaning that a small variation in the input shall result in tremendous changes in the output. If you need more precise explanations, I recommend looking at a simple hash function like md5. The source code is publicly available. Just try to 'invert' it!


HIPAA compliance: how much does it matter? I'm working with an android app sending data to a service hosted on AWS. The provider specifies that AWS in itself isn't HIPAA compliant.

In which way should this by a source of worry? Regardless of the nature of the data, what specific elements makes this a problem? It seems to me that it not so specific from a cyber security perspective?

EDIT: This is not for a health care application. However the service provider mention it is not compliant on its website - therefore I want to know what practically this compromises (or not) from a security perspective. I know that some clients in some applications (or governement agencies) will not use services not compliant with certain standards (such as HIPAA). However, to me it doesn't mean that being non-HIPAA is unsafe - for all I know it could easily be mostly about PR and not so much about security of the service/data on the server.

All the comments posted before this are correct - unless this is a healthcare application, it probably shouldn't make a difference. The statement you're talking about is probably just to help prospective customers choose one service over another.

Also, if this is any large organization, it's highly likely that they're already auditing their infrastructure and I'd even dare say a larger company might pass an HIPAA compliance audit.

tl;dr: It doesn't matter unless you're dealing with patient's data


How to avoid XML vulnerabilities in Python? I am writing a suite of Python 3 applications (including first a command line utility, second an HTTP(S) proxy) which deal with XML.

Today I've discovered that there are several vulnerabilities related to XML.

My main question: Is it worth to entirely switch to defusedxml? I don't think it is necessary for non-DoS attacks (such as access to local files through SYSTEM entities). So defusedxml is necessary only against DoS attacks, right?

If it were for the command line utility only, for such attacks as billion laughs, it would be enabled to run my program under ulimit.

But despite I am now focused on the command line utility, I want my current work to be used in the multi-user HTTP(S) proxy, which I am going to write too.

Is it true that to make the proxy, I need to use defusedxml to protect against billion laughs and similar attacks? Then will (after I use defusedxml) it be enough to limit the size of downloaded XML files? Or do I need some (which?) more advanced counter-measures? Or some other kind of countermeasures?

Is it worth to entirely switch to defusedxml?

Whether it is worth it not only depends on the threat that is mitigated but also how much extra work it is for you to use defusedxml instead of any other library. While I can give you security advise, only you can answer that question.

I consider XXE (XML External Entity (XXE) Processing
) a more serious problem than billion laugs. XXE may expose files on the local filesystem by defining entities that read files:

<?xml version="1.0" encoding="ISO-8859-1"?>
  <!DOCTYPE foo [
   <!ELEMENT foo ANY >
   <!ENTITY xxe SYSTEM "file:///etc/passwd" >]><foo>&xxe;</foo>

For many XML libraries, it is possible to disable DOCTYPE handling or entity expansion, and that would make handling untrusted XML safe. The advantage of defusedxml is that it comes with the secure settings by default, and you don't have to worry about that.

Don't base your security on XML validation or sanitation before parsing it. Creating a regex filter that recognizes XML entities that cannot by bypassed by the attacker is close to impossible.

  I need to use defusedxml to protect against billion laughs and similar attacks?

Most libraries can be configured to protect against XML attacks. You don't need to use defusedxml.

  Then will (after I use defusedxml) it be enough to limit the size of downloaded XML files?

Using defusedxml or disabling the DOCTYPE and entity expansion features will make the XML behave more like you would expect. Limiting the size is a good idea, but not strictly necessary. The power of billion laughs is that it takes up a lot of server resources with a little of the client's resources. A normal XML will take about as much server resources as client resources.

  Or do I need some (which?) more advanced counter-measures? Or some other kind of countermeasures?

Not for XML related vulnerabilities, no.


BeeF - How does it work? I'm mainly server sided. I haven't worked with JS that much before.

My coworker was talking about BeeF and how it basically controls the victims browser just by a simple xss attack.

I was wondering how it's possible. Javascript only executed when the user is on that page correct? So when the user leaves that page, how can they still be controlling their browser if the JavaScript isn't running? Because BeeF documentation says the malicious javascript checks for commands every once in a while but it's not possible if the user isn't on that page with the malicious javascript.

BeEF has 4 ways to keep user browser hooked -

Create popup under the browser to keep BeEF js code executing,
Prevent closing tab with BeEF code running by asking confirmation
Open new pages in foreground iframes
Capture all link clicks and load new pages through ajax, without reloading page.

Details are here: BeEF Persistence


How does Google or any other social media sites know what password I've used previously? When I ask to change my password, Google sometimes doesn't allow identical passwords to ones that I've used before.  Is there a reason why this happens?

These sites store your previous passwords in some form. It could either be in plain text (i.e. the password as it is) OR a hash (eg. SHA256 or better) of it.

Storing plain text passwords is a bad design security wise because it leaves your password in the database which can be reused as it is if the database is compromised.


Do fake wp-login pages help prevent webapp attacks? Many bots attack websites by trying to find an admin login page (such as wp-login.php) and trying to login.

Would an effective way to stop these attacks be to create a fake (non-login) page for the targeted URLs?

Stack Overflow does this by redirecting to YouTube: stackoverflow.com/wp-login.php

Using non-standard paths for your WordPress login and admin pages would stop automated brute-force attacks scanning for every example.com/wp-login.php, but the practice you describe is just messing around with the attackers and doesn't really do any good nor harm.

Best way to stop the bots is to use strong passwords and Fail2Ban.

A fake wp-login & wp-admin could be used as a honeypot for learning more about the ongoing attacks, though. I like to collect the attempted login credentials to know which leaks are currently popular. I also let the credentials "work" randomly to collect the malware they are trying to install. Of course it doesn't work, because it just looks and acts like WordPress without being one. However, by reverse engineering the malware I'm able to learn how it's trying to hide, which gives me an advantage when cleaning infected sites for customers.


Local Network Data Sync and Access Log We have some confidential data for our research. Currently, we use an encrypted hard drive for storing the data and any researcher using the data takes it off the drive.

However, we do not have any way of knowing where the data copies exist at a certain point in time and it is generally up to the researchers to manage their own copies. Also, the external hard drive needs to be locked up and may or may not be available when needed because someone took it or the person managing it was out of office or whatever.

EDITED FOR CLARITY:
I'm looking for a way to have the data shared with the section on a local area network (even in un-encrypted form) with the caveat that the user's have to log into the file server using their institution emails. Once they download a file, it is logged somewhere that person x took a copy of the file y.

Once they have taken the copy, we don't police them about it. It is more self reporting where once they've used the file and deleted it, they log back in and sign off somewhere that they deleted the copy. Once in a while we (or the server) look up if any files have not been reported back and email the person to confirm if they have in fact deleted their copy.

I should re-iterate that this is not a matter of trust but more a check-in / check-out thing.

I know I can probably do this by having a web server hosted on the machine having the files and user's have to log in to get access to the web page that can then track which files they take but I have a gut feeling that there must be a more elegant way of doing this than files over HTTP and that there should probably be something out there that does something similar already.

Also, any thoughts on reliability? Can I have data backed up automatically or synced without using a cloud service that may potentially have leaks (or a private cloud service that is reasonably secure and recommended for this application).

Apologies if this sounds naive. Security isn't my strong point.

Logging who accesses data is possible, but tracking what they do with it once they have accessed it is near impossible. This is similar to the basic DRM problem. On one level, you want to give legitimate users access to the data, but on another level, you want to control what they do with that access. Unless you have complete control over the systems they use, this is pretty much impossible. To some extent, you need to trust your researchers. You can assist them to do the right thing, but based on what you have outlined, I don't think there is any way to gurantee that copies of data are destroyed and no other copies of those copies were made.

There are various approaches you can use, but they all come with significant overheads, have impact on the usability and can be very expensive. For example, you could provide individual encrypted copies of the data and individual decryption keys and a formal process for researchers to obtain copies of the data. The researcher would need to decrypt the data to view it using their key. However, this may greatly complicate their ability to use the data with various research/analysis systems, requires a private key management system, requires additional support for those who have problems using the keys, lose their keys, etc etc. If you provide the sort of flexibility which would allow the researchers to input the data into other applications for analysis etc, you are also providing them with means to copy the data. Once they can do that, you have no way of knowing when/if all copies have been destroyed or not. Even knowing with any certainty that data has been destroyed can be tricky, especially for those without good understanding - many users still believe that once a file is deleted the data is gone.

Obtaining secuure backup of your data is less of an issue. There are many solutions out there that provide various levels of security with respect to data backup. There is no requirement to decrypt your data to have it backed up and provided you use a reputable service provider, the risks are probably no greater than the risks you already have having the data available on the network. Is the external drive locked away in a secure location, such as a safe, when not in use? If not, you likely have a higher risk of someone just walking out with it in their pocket!

I suspect you really need to do a good risk analysis and work out what your top risks are. How sensitive is your data in reality? What is the potential damage should the data be compromised? What is the potential benefit to unauthorized people accessing the data? Are you protecting against active attack or against more accidental loss, such as a researcher leaving their laptop on the bus? Is it possible to modify the data such that sensitive information is reduced without impacting on research requirements? I have worked in areas involving medical research where we had different classes of the data. The less sensitive data had all information which could be used to personally identify an individual removed, replaced with some other key or randomized. The specific medical details still represented real world data, but could not be directly linked to a specific individual. The 'master' data contained all sensitive information, but required additional process and approvals before it could be used for research etc.


RSA encryption with plaintext+random data I have a battle-tested black box crypto library which was developed by industry recognized experts. This box keeps your private key in a hardware backed, tamper proof storage. It only does one thing. Takes an 8 digit all ascii chars as input, encrypts it using RSA and returns the ciphertex. Extreme measures are taken to prevent known side channel attacks and the encrypted information has no monetary value. No-one has any motivation to attack this system. And I am just a developer. Dont know anything about asymmetric cryptography. And for some reason I want to encrypt my name using this magic box, repeatedly. Over and over again.
If this was AES, I would use an IV. Not that I know what an IV is but people on the internet says it is good to add some randomness.
Now, I just wonder, theoretically, does adding a timestamp to my name before encryption improves the security of my cipher?

Original question:
I am supposed to encrypt a user's ID with user's public key. For encryption, I have a blackbox crypto library. The library is assumed to be safe and secure, I have no control on it.  I just select RSA or EC, give it the plaintext ID and it gives me the cipher-text. I will be encrypting a user ID each time a user logs in and the ID never changes. Would it make my implementation any safer if I append some random data or a time stamp to the ID before each encryption?

The seminal work of Shafi Goldwasser and Silvio Micali, Probabilistic Encryption, 1984, change the way we consider security. We no longer use/prefer/recommend non-probabilistic encryptions.

For the security of the RSA encryption padding is required and there are two different paddings is definded PKCS#1v1.5 and OAEP padding, both can be found in rfc8017
Since you have PKCS#1v1.5, let's talk about here a little;
PKCS#1v1.5 uses the following format
00 || BT || PS || 00 || D
BT is the block type
PS is the padding string
D is the data

|0x00|0x02|Random non-zero bytes|0x00|data|

The first byte (also called octet) zero 0x00 guarantees that the message size < modulus size in an integer value.

The next byte (block type) 0x02 indicates the PKCS#1v.5 padding.

The non-zero random bytes (padding string) guarantees that when the same message is encrypted again under the same public-key ( actually public key is a pair (n,e) ) will be different, if each encryption, a new random value must be used. And this is in the standard.
Of course, we have the birthday bound here. Let assume that one uses the 2048 RSA modulus then it has 256 bytes. If the data has 8 bytes then we have 256-8-3 = 245 bytes for the non-zero random bytes. Then you need to encrypt the same message around sqrt(255^255) to have the same encrypted result with 50% probability. The collision is negligible.
The size of this non-zero random byte cannot be less than 8 bytes. So we say, PKCS#5v.14 has at least 11 bytes of overhead.

The next 0x00 is the delimiter.

The last part data is your data

Note 1: I would like to note that the incorrect implementation of PKCS#1v1.5 resulted in many attacks. OAEP is easier to implement and both have the security proof ( we have waited very long for PKCS#1v1.5)
Note 2: When RSA is used without padding we call it Text-Book RSA.


Sending passwords securly over the net: javascript? I believe SSL is decrypted and encrypted from your computer to the receiver right? Well is it possible to use any type of encryption (Stanford crypto lib?) to get a password safely over the net these days?

Well bulk password collection ISP side of course...

And what if people started a movement thing to get an "Extension" for (Chrome, Firefox etc)  of some sorts that could hold the library so a later MITM attack to load malicios javascript would not be possible?

Properly implemented TLS provides end-to-end encryption between the client (your computer) and the server so that any passwords being sent should not be visible to any passive attacker along the wire.  TLS also resists active attacks by require that certificates be verified by Certificate Authorities.  If you are the server operator, you can make future man in the middle attacks harder by implementing Strict Transport Security.  STS ensures that future connections by the same user agent will also connect over an encrypted channel, and enhances certificate errors on future connections (generally, users will not see a "proceed anyway" option if the SSL connection is being tampered with).


What effect would removal of RSA tokens from mobile phone have on surveillance? Reading the comments at Bruce Schneier's blog, I came across this recommendation by someone where they write:

  @Michael_H - Here you go, buy yourself a cheap Huawei G6620 on eBay,
  any network, doesn't matter which, then you'll want to go into
  Security Settings (5) Certificate Manager, now DELETE all the RSA
  tokens.. Then back out and goto web'n'walk service - settings (6)
  Trusted Certificates and DELETE all RSA tokens.

  Now your Telecom's provider has no way to access your device remotely
  @ ALL...

  Can't see your contact's, can't access your Phone Book, Can't see you
  on there GPRS..

It looks like the person recommends Huawei G6620 because that phone allows the deletion of the RSA tokens.

Now assuming that the Telecom provider, or other parts of the government, use those RSA tokens as part of their setup to access data from your phone....

...wouldn't deleting them at most force the telecom provider (or government) to use a non-encrypted channel to access the data on your phone?

Or is there some other "benefit" against surveillance from deleting the RSA tokens?

I suspect that by "tokens" he means RSA keys or RSA certificates. In this case (SWAG) the phone contains the providers public keys which allows the provider access via  authenticated connections.

The phone probably (SWAG here) doesn't allow unauthenticated incoming connections, or doesn't allow it for certain things.

Now, whether that is accurate or correct I can't say.

OTOH, the comments on Schneier's blog, well, some of those people are bugf*k insane, some are trolls, and some are genuine geniuses. Given that people in Cryptography have a tendency towards almost clinical paranoia it's hard to tell which.


Theoretically, If you know the hash of a program one intends to install and you generate another file that hashes to that value what could you do? If I know the hash of a program you intend to install is d306c9f6c5..., if I generate some other file that hashes to that value, I could wreak all sorts of havoc. - from https://nakamoto.com/hash-functions/

Theoretically, If you know the hash of a program one intends to install and you generate another file that hashes to that value what could you do?

Many application control products (aka, application whitelisting) use hashes to identify approved executables. If you duplicate the hash of an approved file, that would be sufficient to execute applications in most cases where such controls are used. Code signing also relies on file hashes.

The security of these products stems from two sources: first, it is very difficult to generate a preimage collision. (Your proposed attack is based on finding a preimage collision.)

Secure hashing algorithms are expected to be resistant to preimage collisions. This expectation can only be satisfied by mathematical evidence that stands up to examination by cryptography experts. There are a number of hashing algorithms that have no known, practical attacks. E.g., SHA256, SHA512, and SHA3.

Right now, the SHA1 algorithm is deprecated because a combination of new techniques and growth in compute capabilities have rendered it vulnerable to such collisions. The method requires thousands of dollars of compute (at bulk cloud compute rates), but it is feasible for well-funded organizations.

The other factor which makes preimage attacks difficult is that you may not know the hashing algorithm chosen by the target. It is essentially impossible to generate a collision for multiple algorithms. E.g., you cannot create a file that collides with the MD5, SHA1, and SHA256 hashes of another file simultaneously. So, you would need to know which algorithm to target.

In summary, there are serious implications if you can generate preimage collisions, but hashing algorithms are designed to make this virtually impossible for precisely that reason.


Encrypt links in Android app I want to hide the links to my server address in my Android app. When my app is  decompiled, the links are clearly showing. Even with the proguard enabled I am not able to hide links. How can I protect these links?

This is a fool's errand.  Even if you you could obfuscate them sufficiently in the source code, it would still be child's play to hook the device up to a proxy like Fiddler or Burp Suite, and see the raw URLs plain as day when the app is running. No need to look at your source code at all, and there is absolutely nothing you can do about protecting HTTP requests, and even HTTPS requests in this case, for several reasons.

So, was suggested in the comment, you need to protect the endpoints exposed by your server via authentication and authorization. Disguising the address is simply not a viable option.