Is it better to choose a single vendor or multiple vendors A discussion came up at work recently and a debate ensued regarding choosing a vendor. Several people were of the opinion that it is smarter and easier to choose a single security vendor for all our needs (lets say for example McAfee as they offer a large number of different products(and lets imagine that they don't just buy different companies and re-brand their kit)).
I however have always been of the opinion that purchasing for multiple different vendors and buying exactly the device you need for the job your trying to fix is the better way of doing things.

Obviously central management is possible when using a single vendor but at the same time, that single console might control all your security devices which means if its compromised, your really screwed.

What are the pros and cons of choosing multiple vendors vs a single 'partner' vendor from a security standpoint?

In no particular order and off the top of my head:

Single vendor:

easier and faster relationships
(usually) better integration of different products, provided they're not rebranded kits
simpler to "pass the buck" if products A and B don't see eye to eye - they're both the same vendor's responsibility.

Multiple vendors:

less risk of vendor lock-in
more competition, therefore possibility of lower prices
more difficult to keep track of licenses and contacts
risk of work duplication between different products (company A has a product that performs 1, 2, 3; company B has another performing 3, 4, 5. Task 3 may in some cases (e.g. antivirus) even lead to conflicts).
more possibility of precise tailoring of each product to your needs

As you see, the multiple vendor solution appears to have more "cons" - but these points shouldn't just be counted, they ought to be weighted in every specific situation. Also, most points are hypothetical, they are risks or opportunities, and whether they occur or not depends on the vendor(s) and situation.

I believe that neither option can be recommended a priori.

The man-hours and cost of maintenance is more or less proportional to the number of vendors, all other things being equal, but the savings (in price, resources, maintenance and productivity) are in percent, and therefore proportional to the number of installations and company size.

In a large company, with workforce and procedures to leverage, and a bigger budget, probably the multiple vendor option has chances to be better. A smaller firm, maybe without a true role dedicated to security, would probably find more convenient to negotiate a single offer and forget about it until next year's assessment.

From a security standpoint, I believe that what really counts is the product ecosystem: what products are really from any given vendor (instead of products rebranded and, perhaps, only maintained by the skeleton crews that survived the original company's acquisition), how they are supported and the vendor commitment to those products: best of all would obviously be a company that guarantees strong support to all its products, not only "flagship" or "developed-here" ones.

In my experience, "acquired" products are comparable to the original for the first version, appreciably worse for the next release(s) (when the acquiring company tries to shoehorn the product into its own shape, e.g. changing the UI or moving config files to XML and such), then improve steadily (or get ditched) as the programming teams get their act together.

What really makes the difference (but this is my own limited experience) is how much time (and budget) you can devote to following the products - checking updates, security alerts, browsing the forums, and maybe run some tests yourself on the side. How much the vendor ships a product because it believes in the product, instead of keeping it up so that they can make a "complete offer".

Usually, checking the contact pages and inspecting product and update history is enough to assess the level of commitment that product enjoys.

There is usually an argument about "biodiversity" in security products, that more or less boils down to:

several products from the same vendor and code base are likely to share the same vulnerabilities.
different products may have a "security overlap" so that what is not protected against by the one, will be intercepted by the other.

I believe that both points are close to moot (except insofar they descend from the vendor's attitude, if you will):

several products sharing common code will have that code tested harder, longer and better, and the bugs in there will be fixed once and for all. While different implementations of a same algorithm, sharing a conceptual vulnerability, will likely lead to staggered fixes and several vulnerability windows.
two products having an "overlap" is the same thing as either conflicting products or duplication of effort. If I want overlap, I purposely buy two products so that I can control the overlap - instead of relying to a chance duplication, whose extent might not even be fully known (because two products from the same vendor will have two different focuses; the overlap then will likely be in the "peripheral vision" area of both. If it's something that comes for free, an extra, I can enjoy it; but rely on it? Think again).

Here, again, these factors have to be assessed vendor-wise and considered in the light of your company's policy, budget and needs.


Will SIM‐like PIN on website as second password increase security On SIM cards, which are used in mobile telephony, PIN (and PUK) is used. Unlike a password, they are locked after some incorrect attempts to prevent brute force attack. If wrong PIN is entered 3 times, user must enter PUK. When wrong PUK is entered 10 times, SIM card is permanently disabled.

On the website, if wrong PUK is entered 10 times, user must contact customer support to unlock their account. To prevent abuse, user must enter their password first.

Will adding PIN/PUK as second password increase security? Should it be added?

This would help prevent credential stuffing, but would only catch a couple edge cases and is not as effective as adding a 2nd authentication factor. The specific attack vector this would protect against:

A user uses the same password on your site and another site
The other site, like most, doesn't use a PIN to supplement authentication
The other site gets breached and leaks the user's password
An attacker uses the breach to attempt to log in to your site as that user
The attacker doesn't know your user's PIN, and ultimately can't log in

The biggest issue here is that 2fa covers this exact case, as well as significantly improving the security of your auth flow. There are a couple mobile applications that use a PIN in lieu of a password, as it's easier to type on a phone, but this doesn't seem to be applicable to your question.

There's no reason to use a PIN in addition to your auth flow - either just use a password field, or enable/require 2fa for your users.


Linksys Router Tried To Access Local Website I'm running a simple Node.JS HTTP server on my computer to test things before I push them to my real server, and forgot to close it when I stopped using it.  I just looked at the logs and it shows that my home router (Linksys EA6900, 192.168.1.1) tried to load /HNAP1/ and /JNAP/:

Time IP ResponseCode PageRequested MimeType

2018-04-08T03:26:21.784Z 192.168.1.1 404 /HNAP1/
2018-04-08T03:26:21.881Z 192.168.1.1 200 /index.html text/html
2018-04-08T03:26:21.887Z 192.168.1.1 404 /JNAP/

All I can find online about this is what the HNAP protocol is and that there was a mass Linksys router exploit a few years ago, but this exploit was supposedly fixed long before I bought my router.

Is this normal for routers to try to do, or is my router possibly compromised?

EDIT: I just finished chatting with Linksys Support, I'm left to assume it's part of the Smart Wifi as he said the page requests are part of the router and it is needed ... since the router won't function without those

HNAP is the Home Network Administration protocol.

I once ran in to the same issue when I was monitoring my network, only it wasn't with HNAP, but it's predecessor: UPNP.

Your Router should have a setting to enable or disable this feature, but it should be harmless if it's not exposed to the outside.

Basically, your router checks it's arp tables for available devices and sees if they have a HNAP service active by probing the directories you listed above.

I turned off the UPNP Service from my router configuration and things went silent, so I'd check the documentation of yours to do the same.


Why not make the second factor the only factor? Most websites use a single-factor based authentication mechanism, the password. Some popular websites, however, also implement an (often optional) two-factor mechanism to log in; usually requiring the use of the password and responding to a challenge that can be obtained from a device the user has.

There are a few websites, such as Medium, which has taken this idea of two-factor authentication the other way, by keeping only the second factor. However, Medium implements this by sending a link to the user's registered email address.

Medium argues that such a scheme is quite secure as well as being convenient for the users. Their arguments mainly boil down to:

While password managers are a secure way to deal with the problem of having to remember and type in passwords, in case where the password storage of a website may be compromised, it still requires changing passwords; and with some or the other website being compromised each day, it does not make for a good experience on the part of the user.
A compromise of the email account of the user would imply the compromise of all the accounts linked with it, since most websites allow for password resets by sending an email with a link in it.

I'm having trouble finding a good argument against such a scheme where the first factor is eliminated/replaced for the second factor.

So, why isn't the second factor of authentication more commonly made the only factor, especially in the case of websites that implement just single-factor authentication by the use of passwords? In other words, why not make the challenge-response the only factor instead of having a password?

What are the disadvantages to such a scheme?

There is some debate as to whether an email address can be actually regarded as a second factor; however, I'm asking about the idea in general — the challenge can be, for example, (sent to and) retrieved from a device that the user has.

I think there are two independent questions here that you need to distangle.

Question #1: Should I use just one factor or should I use two?

This is the question that you adress in your title - "Why not make the second factor the only factor?".

Two factor will be safer than one, but it comes with a usability and an implementation cost. If it is worth the cost depends on what your customers are prepared to accept and how valuable the thing you are trying to protect is. For a bank 2FA is almost a must, for an online hobby forum is is probably overkill. No general one size fits all answer is possible.

Question #2: If I use just one factor, which one should you pick?

This is the question the link to Medium (mostly) adresses. It is not the same as the first question.

This basically boils down to "what kind of authentications is best" - obviously a very broad question without a definative answer. But lets look at the scheme you mention.

Using email instead of a password? Can probably be a good idea for a low value target. My hobby forum on shared hosting is way more likely to be breached than the GMail. But if I am a bank this is probably bad, since some customers might have very weak email providers.

Using smartphone instead of a password? If your primary threat is large bot brute force attacks or reused credentials from other breaches this is probably a good idea. If your primary threat is snooping from someone close to you this is probably bad - there are probably a few people in your life that has easy access to your smartphone. So for the hobby forum I would say yes, but for Ashley Madison maybe no. (Or on second thought, maybe it would have been the best for them...)

I think the take home lesson here is that the one factor does not have to be a password, but what it should be depends on the specific circumstances of your situation.


If I never want cross origin requests to be accepted, can I just ignore CORS? The CORS spec states that if a request method and headers are not simple then a preflight HTTP OPTIONS request is sent to see if the request is allowed by the server.

My server does not respond with any CORS specific headers, so I am assuming this means the request will be denied. A security firm recently told me that this means the request will always be accepted if I don't specifically deny it with CORS headers, but I find this hard to believe.

Also, some older browsers don't implement CORS at all, so I am wondering if there is a security hole here that these browsers may be able to bypass the CORS check? Or do these browsers just always deny everything?

Summary: I never want cross origin requests to be accepted. Is there a security hole with just pretending CORS doesn't exist?

No.  There is no security hole in just pretending CORS doesn't exist.  CORS is an opt-in policy.  As long as your server never sends any CORS headers (never opts in), browsers will continue to use the standard same-origin policy.  You can pretend CORS doesn't exist, to keep your life simple: that's a perfectly reasonable strategy.

CORS is optional: you can use it if you want its extra features, but it is also perfectly fine to ignore it and never use it.  This is by design.  Anything else would be crazy.  There are millions of web sites out there which were written before CORS and aren't ever going to be changed.  Designing a standard which overnight made all of those websites would be crazy.  The CORS standards writers aren't crazy.  They didn't do that.  (In fact, they took great pains not to do that!)

I suspect there has been some miscommunication or misunderstanding with your security firm (or possibly your security firm is just wrong).  As far as I know, it's fine for a web application to never send any CORS headers.

That said, you do need to understand CSRF.  CSRF is a fundamental vulnerability on the web (one which far predates CORS, and is orthogonal to CORS).  So, please do read up on it.  You'll find a lot of great resources on CSRF on the OWASP web pages and on this site.  The standard defense against CSRF is to use CSRF tokens for all HTTP requests that could possibly have any side effect.


ADFS 3.0 OAuth2.0 against client applications ADFS 3.0 does not support the Implicit Grant client flow of Oauth2, nor does it support client secrets.

Initial investigations suggest it is not secure to use the Authorize Code Grant flow from a native client application as it exposes the client secret but ADFS 3.0 does not suppport client secrets.

Is it possible to use the ADFS's implementation of the Authorize Code Grant flow securely from a native client application? (I'm thinking no).

Yes. Using the authorization code flow client side will have almost the same effect as using the implicit grant flow.

There will be a few extra requests but the end result will be the same with some caveats:

The implicit flow spec says the token must be in the URL's fragment so it doesn't leave the user-agent. You won't have this with the code flow
You should not enable refresh_tokens for the client.

Also the same security concerns as for the implicit flow apply. See RFC6748 section 10.16:

  Authenticating resource owners to clients is out of scope for this
  specification. Any specification that uses the authorization process
  as a form of delegated end-user authentication to the client (e.g.,
  third-party sign-in service) MUST NOT use the implicit flow without
  additional security mechanisms that would enable the client to
  determine if the access token was issued for its use (e.g., audience-
  restricting the access token).

And on the client credentials front you were already covered:

  Native applications that use the authorization code grant type SHOULD
  do so without using client credentials, due to the native
  application's inability to keep client credentials confidential.

Footnote: Be sure to read RFC6819 section 4.4.2  to avoid other common implicit flow pitfalls.


How do cookie and session implement for preventing reuse elsewhere I have some scenarios:

A cookie is generated on Chrome and will be used in Firefox in the same machine.
A cookie is generated on Chrome and will be used in Chrome on a different machine.
A cookie is generated on Chrome and will be used in Firefox on a different machine.

In above scenarios, can cookie be reused? If not, how to implement a session/cookie to prevent reuse in those scenarios?

In my opinion, I think a session-cookie is implemented by:

server stored a key-value pair so: key for identity user. and value for store user data, expired session time ...
client will store cookie, in that cookie contains key on server.

So above attacks can be prevented by value object stores something such as "browser type", "machine name" (getting ssh value by some way). Every time user requests something, server will get browser type, machine name, cookie and check all data for validity.

But what is the problem if attacker can fake the browser type, machine name? For example, using Firefox but sending Chrome-details as browser-agent instead.

You should think about threat models instead of coming up with solutions to fake problems.

What's the threat model here? That I copy my own session cookie to another computer? Not a real threat.

Worried about javascript stealing cookies? Use httponly cookies

Worried about malware stealing your cookies? Use a dedicated computer for sensitive network communications. You can get a Raspberry Pi Zero Wireless for $10


Dovecot TLS connection handshake ChangeCipherSpec I added a virtual domain to our mail server today then did a check of the Dovecot TLS connection security.  The test was done from a remote host using Thunderbird.  I captured the connection with tcpdump and then passed that to ssldump.  I also used nmap to verify the allowed ciphers.  That all can be found in a pastebin here.

I do not understand the server->client ChangeCipherSpec (where it says using TLS_RSA_WITH_RC4_128_MD51 10 0.5695) I may just be confused about how the TLS connection is setup but I have no RC4 type ciphers enabled so how (or why) is this happening?

I came across this issue myself recently. We would run ssldump and openssl s_client at the same time - openssl would show that the active cipher is AES256-SHA yet ssldump would still print TLS_RSA_WITH_RC4_128_MD5 in its output.

I believe I found a bug in ssldump. Looking through the source code I found the following:

The SSL handshake packets are decoded in the function decode_ContentType_handshake() in ssl/ssl_enum.c:20
This function then calls ssl_decode_switch(ssl,HandshakeType_decoder,t,dir,seg,data), where HandshakeType_decoder is an array of decoder structs\
ssl_decode_switch(ssl,dtable,value,dir,seg,data) (ssl/ssl_print.c:204) iterates through the dtable array until it finds the decoder entry with type == value or type == -1 ("not found")
However, looking at the definition of HandshakeType_decoder in ssl/ssl_enum.c:212 the array is not terminated with a decoder struct with type == -1 - there's a 0 at the end
Also, immediately following the HandshakeType_decoder definition is the definition of cipher_suite_decoder (ssl/ssl_enum.c:266) which is an array of the same struct decoder. This array contains a list of ciphers.
This means that if the SSL handshake type is not found in HandshakeType_decoder, ssl_decode_switch() will continue searching in cipher_suite_decoder as it will (most probably) be in memory directly following the HandshakeType_decoder data
And this turns out to be happening in my case. For some reason decode_ContentType_handshake() decoded the handshake packet to be of type 4 which ssl_decode_switch() couldn't find in the HandshakeType_decoder. However, by coincidence 4 is the type value of the cipher_suite_decoder entry with name == TLS_RSA_WITH_RC4_128_MD5

I run out of time to investigate this issue so I don't know why ssldump is trying to decode a handshake packet with invalid type. I'm however convinced that the HandshakeType_decoder array should be terminated with a -1 to prevent the overrun.


Desperate for removing spywares from both iPhone and Mac PC I hope this is the correct stackexchange website to ask this, if it's not I'm sorry.
Some time ago I started giving private lectures to a girl and she told me, a computer engineering student,  that someone she knows is hunting her and managed to gain access to both her mobile phone (some iPhone I think, she generically said 'apple') and personal computer (also Apple), downloaded her personal photos, peered into her google account, changed her passwords many other thing, and she's been struggling for almost one year now to try getting rid of it.
While I'd love to work into information security one day, I don't have enough knowledge about the Apple world to help her on my own and I thought when she'll be back (she's away on business right now) that a good way to protect her would have been to

Doing a clean install of her mobile phone's OS
Doing a clean install of her PC
Setting a 2FA or MFA on her google account so that to access anyone needs to be physically in possess of her mobile phone
Blocking all the incoming SMS (I know you can be infected via external links from SMS messages, she thinks she shouldn't be forced to do this and she wants to behave like she did before this all happened, and I feel her, but this way she'll never be completely safe).

Is there something else I can do to remove everything and keep her safe? I know some malwares and spywares literally infiltrate into the bootloader or the BIOS and if this is the case (can't tell if it is) just clean installing won't be enough, nor a factory reset... We're willing to pay specialized technicians to do the job, no matter the price, just in case do you know any reliable company that can do the job?
Thanks!

Unless she is a very high value target, this sounds like an iCloud breach and not malware on her iPhone and Mac.  It's a pretty intense breach to hit both an iPhone and Mac these days and far easier to gain access to her iCloud account.
I'd recommend having her change her iCloud password and enable 2FA.  Then, see if she can look at her login records on iCloud to confirm an attacker.  In addition, ask if she's recently gotten weird emails from what she thought was "iCloud" asking her to enter in her password or some other quick action needed.


My friend hashes passwords with SHA512 algorithm without salt. How do I convince him that he needs to add salt? Today I discovered something incredibly stupid - my friend hashes user passwords with sha512 algorithm without a salt. I immediately raised this issue to him but he said he wants to see anyone crack a single password in his database. I told him that without a hash his database is vulnerable to rainbow attack but he said no one had this large rainbow table for sha512 as each has is 64 hex characters long.

How do I convince him that he still needs to add salt? Does anyone know what the hash cracking rate of sha512 is? I could argue then that it would take this much or that much time to crack all 8 char passwords, etc.

How about you take his challenge? Go make a quick rainbow table of common passwords and run it over his database.  You're bound to hit something (especially if he doesn't have a password policy).  However, this may not work if he has a small database.


Automatic connection from LSASS to different IPs. Is this the usual behavior? I'm using Windows 7 and Firefox 22, connecting through a regular residential wifi router.

In the last month, I've noticed that when I connect to the internet once in a while my firewall indicates that lsass wants to connect to different IPs.
example:

C:\WINDOWS\SYSTEM32\LSASS.EXE
Local Security Authority Process
Remote IP: 72.21.91.29
Remote Port: 80

I'm not sure if the following is related but since the same time ago, when I connect to the internet, svhost tries to connect to port 80 to multiple certificate website like DigiCert etc.

After trying to search on Google I couldn't find a reason why is connecting to any IP and if that could be something to worry about and investigate a bit more. I haven't found anything about the second situation for this same context (pc, I am not using remote desktop neither I have the functionality enabled, it happens or just after connecting or surfing the web, this is a NEW behavior. I have two wifi to connect. One is shared with 2 more persons but none of the pcs are sharing or in a family group, the other wifi is used only by me and still, the same firewall messages show up). My first guess is that a Windows update for increased security for ipv6 (compared to the one I had) was installed?

Is this clear indication of a spyware or trojan horse or is just the usual behavior of these processes?

This is a normal part of certificate validation or revocation list update using the OCSP protocol.
Enjoy reading:
https://technet.microsoft.com/en-us/library/ee619730(v=ws.10).aspx
https://en.m.wikipedia.org/wiki/Online_Certificate_Status_Protocol


How does a user get authenticated on server B if they are already authenticated on server A through OAuth2? Lets say I have server A (a web server). Users initially use an external provider such as Google to get authenticated on that server. An entry is created in my database saying that this user has logged in before and has confirmed their account. They now have access to resources such as a forum available from the web server (so essentially we created a local account for them).

Now, the user wants to get authenticated on server B (a game server). Server B is accessed through a desktop app (game client) through TCP. Also, we have a gate server C that will handle initial requests from desktop clients before being able to connect to server B.

The entry created for that user previously, is required to access server B and/or C. Hence, the desktop app should open a browser to authenticate our user on server A.

What is the general flow required to implement such a system? My point of confusion is even if server C knows the user is authenticated (by exchanging access tokens with server A), what information do we pass to the desktop client and server B so when the client disengages from server C, they can be sure server B will not reject their connection attempt (assuming the request is legitimate)?

First I would define all the roles of all the nodes you have. Looking at your architecture I would pretend that gate Server(C) acts as an Authorization API Gateway which is responsible for managing the tokens which are needed for all authentication and authorization. WebServer (A) and GameSever(B) are the resources which require authorized user to access (using OAuth2 access token or other JWT)

I would define the flow like this:

User opens client desktop which directs him to sign-in using Google
account.
Google responses with identity token (i.e. JWT token) and Desktop client send to Gate Server (C) with information of his client_id and resource he wants to have access (in form of scopes - i.e. game_server)
Authorization API Gate server (C) takes the identity token and on behalf of this creates an access token (or another authoriozation token in form of JWT) and sends to the client desktop which securely saves this.
On every call to Game Server (B) Client Desktop sends the
authorization token and Game server checks that to authorize the
request.

The important thing here is that you have to store the authorization token securely on the client side. This is not easy so I would recommend using something like a reference tokens. On this solution after Game Server (B) gets the authorization token he has to send it to Authorization API to get the token's content (claims). So, in this case, every request from Client Desktop to Game Server (B) results in additional request from Game Server(B) to Authorization API Gateway (C).


Top Mobile Device Security Concerns? What does everyone see as the top security concerns for mobile devices at the present time?  I am working on a paper on the topic, but it seemed worth asking here to see if I might have missed anything.

Sometimes users are the biggest concern because they do not read.

A lot of people root their Androids or iPhones (jailbreak) and forget that they make a device run beyond the normal user rights.

For instance with android this means an attacker might get complete control over a cellphone. Also this means when you install an application not from the market it might include code to access your phone.
If angry birds would ask them to access their contact lists and get access to be able text, a lot of users would just grant it, because otherwise they can't play their game.

(I know angry birds is on the market, but maybe something alike)

The same goes up for an iPhone by the way.


How does malware become executable code? I'm a software engineer and I still don't understand how malware works or what an exploit actually is in software engineering terms.  How do the contents of a website, say, or a file attachment to an email, become executable code on a PC?

File formats like HTML, JPEG, MP3, PNG, BMP, etc, are all read by another piece of software and so should only be able to do what that reader allows it to do.   Something that reads a JPEG file can basically light up pixels using certain RGB values in a display window; there's nothing in the JPEG spec that says "create a .exe file and put it here in the file system and then execute it".    So how do they corrupt a JPEG file to achieve that?  Why would a legitimate JPEG reader have the capacity to execute arbitrary code on a PC, and how would those bits get written to the PC?

Even javascript, which is a scripting-language, is still read by an interpreter and doesn't have direct access to the host's file system - it's sandboxed and can't directly write to the host's file system.

Modern programming languages don't even do direct memory access with pointers like we used to with C in the 80's and I assume that the "buffer-overrun" vulnerabilities that existed in the old days are a thing of the past with modern OSes and hardware memory management.   So even if I wanted to, I don't know how I would write bits into a block of memory I didn't have legal access to, and even if I managed to do that, how would I trick the OS into treating those bits as executable code and execute them?

So how, exactly, does a nefarious website create executable code on a modern PC with a modern OS?

Many of the questions in the original post have already been asked and answered elsewhere on this site. Entire books have been written on some of these topics.

  I'm a software engineer and I still don't understand how malware works or what an exploit actually is in software engineering terms.

If the definition of what an exploit is in the context of computer security is not clear enough, it may be helpful to look at examples of exploit code.
exploit-db is a good resource for this.

  File formats like HTML, JPEG, MP3, PNG, BMP, etc, are all read by another piece of software and so should only be able to do what that reader allows it to do. Something that reads a JPEG file can basically light up pixels using certain RGB values in a display window; there's nothing in the JPEG spec that says "create a .exe file and put it here in the file system and then execute it". So how do they corrupt a JPEG file to achieve that? Why would a legitimate JPEG reader have the capacity to execute arbitrary code on a PC, and how would those bits get written to the PC?

How to inject executable, malicious code into PDF, JPEG, MP3, etc.?

How can normal files hide a virus?

Is it possible for a file that is non-executable and read-only to run malicious code?

How can a virus exist in an image?

  Modern programming languages don't even do direct memory access with pointers like we used to with C in the 80's and I assume that the "buffer-overrun" vulnerabilities that existed in the old days are a thing of the past with modern OSes and hardware memory management. So even if I wanted to, I don't know how I would write bits into a block of memory I didn't have legal access to, and even if I managed to do that, how would I trick the OS into treating those bits as executable code and execute them?

Stack Overflows - Defeating Canaries, ASLR, DEP, NX

  So how, exactly, does a nefarious website create executable code on a modern PC with a modern OS?

How can a modern Windows/Linux system be compromised by a heap overflow in Chrome?

Browser Exploits: Attacks and Defense

The AnC attack

CWE-94: Improper Control of Generation of Code ('Code Injection')


Is XSS possible when < is not escaped, but also removed if followed by a character? I have figured out that < wasn't encoded as &lt;.
However it is removed if followed by anything but a blank space. For example, <a will get removed but not  (note the space), which isn't useful.

Except from < character, there is no restriction and no encoded characters.

Here is the code where it gets reflected:

USER INPUT

Here is the content type of the page:

text/html; charset=utf-8

And the content type for the input request:

application/x-www-form-urlencoded; charset=UTF-8

Others specific informations :

Server: nginx
X-Powered-By: PHP/5.5.18-1~dotdeb.1

Is this method vulnerable to XSS?

No, in a HTML context you cannot inject new tags without allowing letters after the opening bracket. Still, this filtering technique is unnecessarily risky.

The HTML parser of your web browser parses code as a state machine. To understand what your options are, have a look at the HTML syntax specification and the possible state transitions.

Your injection point happens to be in the data state (which is the "default" state, outside of any tags):

8.2.4.1 Data state

Consume the next input character:

U+0026 AMPERSAND (&)
    Switch to the character reference in data state.
"<" (U+003C)
    Switch to the tag open state.
U+0000 NULL
    Parse error. Emit the current input character as a character token.
EOF
    Emit an end-of-file token.
Anything else
    Emit the current input character as a character token.

For XSS, the only interesting continuation is to open a tag with < and switch to the tag open state:

8.2.4.8 Tag open state

Consume the next input character:

"!" (U+0021)
    Switch to the markup declaration open state.
"/" (U+002F)
    Switch to the end tag open state.
Uppercase ASCII letter
    Create a new start tag token, set its tag name to the lowercase version of the current input character (add 0x0020 to the character's code point), then switch to the tag name state. (Don't emit the token yet; further details will be filled in before it is emitted.)
Lowercase ASCII letter
    Create a new start tag token, set its tag name to the current input character, then switch to the tag name state. (Don't emit the token yet; further details will be filled in before it is emitted.)
"?" (U+003F)
    Parse error. Switch to the bogus comment state.
Anything else
    Parse error. Switch to the data state. Emit a U+003C LESS-THAN SIGN character token. Reconsume the current input character.

Here your options are a-z, A-Z, !,/ and ?.
You have not been clear about whether special characters are blacklisted, too. But even if they are not, you're out of luck:

From <! you only get to a comment (<!--), a doctype declaration (<!DOCTYPE) or a CDATA section (<![CDATA). These are not real DOM nodes and hence they are useless for XSS. (For instance, you wouldn't be able to attach an event handler to a comment.)
<? might be interesting in XML, but is treated as a comment in HTML.
</ will only let you close tags.

You may have noticed that the specification also doesn't tolerate any padding characters, such as spaces, tabs, newlines or control characters.

If you want to dig a little deeper and verify the implementation, you can always look into the source code. For example, this extract is part of the HTML5 tokenizer used in Mozilla Firefox. As you can see, the tag open state adheres closely to the specification:

case NS_HTML5TOKENIZER_TAG_OPEN: {
  for (; ; ) {
    if (++pos == endPos) {
      NS_HTML5_BREAK(stateloop);
    }
    c = checkChar(buf, pos);
    if (c >= 'A' && c <= 'Z') {
      endTag = false;
      clearStrBufAndAppend((char16_t) (c + 0x20));
      state = P::transition(mViewSource, NS_HTML5TOKENIZER_TAG_NAME, reconsume, pos);
      NS_HTML5_BREAK(tagopenloop);
    } else if (c >= 'a' && c <= 'z') {
      endTag = false;
      clearStrBufAndAppend(c);
      state = P::transition(mViewSource, NS_HTML5TOKENIZER_TAG_NAME, reconsume, pos);
      NS_HTML5_BREAK(tagopenloop);
    }
    switch(c) {
      case '!': {
        state = P::transition(mViewSource, NS_HTML5TOKENIZER_MARKUP_DECLARATION_OPEN, reconsume, pos);
        NS_HTML5_CONTINUE(stateloop);
      }
      case '/': {
        state = P::transition(mViewSource, NS_HTML5TOKENIZER_CLOSE_TAG_OPEN, reconsume, pos);
        NS_HTML5_CONTINUE(stateloop);
      }
      case '\?': {
        if (viewingXmlSource) {
          state = P::transition(mViewSource, NS_HTML5TOKENIZER_PROCESSING_INSTRUCTION, reconsume, pos);
          NS_HTML5_CONTINUE(stateloop);
        }
        if (P::reportErrors) {
          errProcessingInstruction();
        }
        clearStrBufAndAppend(c);
        state = P::transition(mViewSource, NS_HTML5TOKENIZER_BOGUS_COMMENT, reconsume, pos);
        NS_HTML5_CONTINUE(stateloop);
      }
      case '>': {
        if (P::reportErrors) {
          errLtGt();
        }
        tokenHandler->characters(nsHtml5Tokenizer::LT_GT, 0, 2);
        cstart = pos + 1;
        state = P::transition(mViewSource, NS_HTML5TOKENIZER_DATA, reconsume, pos);
        NS_HTML5_CONTINUE(stateloop);
      }
      default: {
        if (P::reportErrors) {
          errBadCharAfterLt(c);
        }
        tokenHandler->characters(nsHtml5Tokenizer::LT_GT, 0, 1);
        cstart = pos;
        reconsume = true;
        state = P::transition(mViewSource, NS_HTML5TOKENIZER_DATA, reconsume, pos);
        NS_HTML5_CONTINUE(stateloop);
      }
    }
  }
  tagopenloop_end: ;
}

So, the XSS filter you describe seems to be safe per the HTML specification. It's very thin ice, tough. You never know, if some vendor comes up with a quirky implementation that could still enable an exploit. (Microsoft, I'm looking at you!)

The correct XSS protection is therefore to simply escape the brackets.


ECDSA/RSA certificates and cipher selection In this image can someone tell me if a standard RSA certificate can support the EC*_RSA ciphers listed? If so do you create the typical RSA keys when you are creating the CSR?

Also I am fairly certain that the EC*_ECDSA ciphers require the use of an ECDSA certificate. Is that correct?

You can only use the ECDHE-RSA ciphers from that list if all you have is an RSA certificate. Same thing for ECDSA certificates, which only can be used with the ECDHE-ECDSA ciphers on that list.

ECDH-* is fixed in the sense that your certificate contains the fixed public parameters for and key, which can be used for the key exchange. This certificate is then signed by a CA with either RSA or ECDSA, which leads to either ECDH-RSA-* or ECDH-ECDSA-* ciphers.

That being said, ECDH is not used much. I don't know what is your reasoning behind listing the ECDH(E) ciphers, but if you want forward secrecy, you should only use the ECDHE-* ciphers, as they generate different keys for every session.


What risk does Carrier IQ pose, exactly? There has been a lot of discussion about Carrier IQ, monitoring software that is pre-installed on many Android phones.  Many allegations have been thrown out.

My questions: What exactly does Carrier IQ do?  What information does/doesn't it record on your device?  What information does/doesn't it transmit off your device?  Could it transmit additional information if Carrier IQ or the carrier transmitted instructions to it to turn on broader logging?  More generally, what exactly is the risk posed by Carrier IQ, if any?  How much should Android users be concerned?  Can we gather a summary of what is known about Carrier IQ?

For instance, I have seen claims that the Carrier IQ information learns about things like keystrokes, text messages, and other personal information, but it does not transmit them (in its default configuration) off the phone.  OK, as far as that goes.  Does it store this information in any log file or any other persistent storage on the phone?  And do Carrier IQ or the carrier or phone manufacturer have the ability to sent additional instructions/commands to the Carrier IQ application, post-facto, to enable it to start logging this information or communicate it off the phone?

Let's break it down by category.

What information does Carrier IQ monitor? Trevor Eckhart says (depending on the phone manufacturer) it receives each key pressed/tapped, the location of any tap on the screen, the contents of all text messages received, the name of each app that you open or switch focus to, information about each call you receive, your location each time location is updated/queried, the URL of each web page visited (including URL parameters; yes, even for https URLs), and possibly other information about each HTTP request.  I have not seen anyone dispute these claims.

Note that this is information that is monitored by the Carrier IQ application; that doesn't necessarily mean that the application does anything with the data, stores it, or allows it to leave your phone.

What information does Carrier IQ record on your phone? It is hard to get clear information on what  information might be stored in your phone on persistent storage or log files.  Does Carrier IQ log the information that it receives?  I don't know.

Carrier IQ says that their software "does not record, store or transmit the contents of SMS messages, email, photographs, audio or video", and they have said "we're not storing" keystrokes and that they "do not record text messages".  However, they also say that they do "record where you were when [a] call [is] dropped, and the location of the tower being used". Lookout says "it doesn't appear that they are sending your keystrokes straight to the carriers".  Dan Rosenberg seems to suggest that the Carrier IQ application is "recording events like keystrokes and HTTPS URLs to a debugging buffer", but it is not clear to me where that debugging buffer is stored (just in the memory of the Carrier IQ application? or on persistent storage of some sort?), and it is always possible I have misinterpreted his statement or read too much into a brief phrase.  Dan Rosenberg subsequently elaborated, finding that on one particular phone, CarrierIQ can record URLs visited (including for HTTPS), GPS location data, and phone numbers, but not all keystrokes, not the contents of SMS texts, and not the contents of web pages browsed.

CarrierIQ has subsequently clarified that their software does record "the telephone numbers the SMSs are from and to".

Trevor Eckhart said that the Carrier IQ software on his HTC phone recorded a lot of personal data (keys pressed, SMS texts, etc.) into a debugging log file, so this information is stored in the clear on his phone.  Carrier IQ has subsequently confirmed this finding.  Carrier IQ says this is because the debug capabilities remained switched on; it sounds like they are blaming HTC for not deleting or disabling the debugging code in the Carrier IQ software.  It is not known whether a similar problem may be present on phones from other manufacturers, or if this is limited to just HTC phones.

What information is transmitted to carriers? Carrier IQ says that only diagnostics information and other statistics leave your phone: "For example, we understand whether an SMS was sent accurately, but do not record or transmit the content of the SMS. We know which applications are draining your battery, but do not capture the screen."  Dan Rosenburg says that the software can also report your location (GPS) in some situations.  Carrier IQ has confirmed that their software captures phone numbers dialed and received and all URLs visited, if enabled by the carrier.

However, Carrier IQ also says that the amount of information that is sent to carriers is up to the carrier, and agrees that the Carrier IQ application has the capability to transmit what applications are being used and what URLs the user visits.  Some of the carriers have not been very forthcoming: e.g., Sprint says they "collect enough information to understand the customer experience with devices on our network and how to address any connection problems, but we do not and cannot look at the contents of messages, photos, videos, etc., using this tool" (not very specific); AT&T says their use of Carrier IQ complies with their published privacy policies, but hasn't said anything more.  Other carriers have been more explicit: Verizon and RIM say they don't use Carrier IQ and they don't pre-install it on any of their phones.  Apparently T-Mobile uses Carrier IQ, but I have not yet found a statement from them.

Carrier IQ has subsequently disclosed a bug in their code which may cause it, under certain special circumstances, to capture the content of text messages and inadvertently transmit it to the carrier, as the result of an unintended bug in their code.

How is the information transmitted to carriers? Carrier IQ says says that any information that is transmitted off the phone is sent over an encrypted channel to the carrier.  I haven't seen anyone dispute this statement.

Can carriers or others command the application to change any of this? I don't know.  I can't tell if there is a way that carriers or Carrier IQ can send a command to the Carrier IQ application to cause it to collect, record, or communicate more information than it does in its normal operating mode.

Trevor Eckhart says that carriers can "push" a data collection profile to a phone.  He also says that the profile specifies what data is collected, stored, and transmitted off the phone by the Carrier IQ application, and that any data that is received by the Carrier IQ application is potentially eligible to be transferred off the device, if the profile specifies that.  He suggests that a "portal administrator" (at the carrier, presumably) thus has the ability to target a particular subscriber, push to them a profile that causes the phone to transmit a broad variety of information (keys pressed, contents of text messages, URLs, etc.) off the phone, and then can view this information.  If this is accurate, it suggests that, even if the application does not normally transmit this information off the phone, the carrier has the ability to force the application to do so.  It is not clear if there is any notification to the user or any attempt to gain consent before this occurs.  I have not seen any independent analysis of these claims.

CarrierIQ has subsequently confirmed that it is possible to send control messages to the CarrierIQ software via SMS, to command the CarrierIQ software to perform certain tasks.  CarrierIQ has not clarified what is the full range of commands that can be sent, or how the CarrierIQ software authenticates these command SMSs to make sure they are not exploited by attackers, so it is difficult to assess the risks associated with this feature.

Other information sources. Wikipedia has a page on Carrier IQ, which includes some updates, a list of carriers and handset manufacturers who do or don't deploy Carrier IQ, some reactions from policymakers, and lawsuits against Carrier IQ.


Are there technical disadvantages in using free ssl certificates? Note this question is related, except this one is about free SSL certs.

There are providers who are offering totally free entry-level SSL certs (like StartSSL). I was wondering if they are technically the same thing as the paid ones (at least with the entry-level SSL certs like RapidSSL and PositiveSSL)? I do understand that extended/organization SSL is a different category, but if you only need entry-level SSL certs, are the free ones technically the same as the paid entry-level variants?

Moreover, if they are technically the same, why would you want to pay for something that's available free?

At the byte level, X.509 is X.509 and there is no reason why the free SSL certificates would be any better or worse than the non-free -- the price is not written in the certificate. Any certificate provider can fumble the certificate generation, regardless of whether he gets paid for it or not.

The hard part of a certificate is outside of it: it is in the associated procedures, i.e. everything that is in place to manage the certificates: how the key holder is authenticated by the CA, how revocation can be triggered and corresponding information propagated, what kind of legal guarantee is offered by the CA, its insurance levels, its continuity plans...

For the certificate buyer, the big value in a particular CA is where the CA succeeded in placing its root key (browsers, operating systems...). The vendors (Microsoft, Mozilla...) tend to require quite a lot of administrativia and legal stuff from the CA before accepting to include the CA root key in their products, and such things are not free. Therefore, a CA which could get its root key distributed but emits certificates for free has a suspicious business plan. This is why the free-cert dealers also offer paid certificates with some extra characteristics (certs which last longer, certs with wildcard names, extra authentication procedures...): at some point, the CA operators must have an incoming cash flow. But, ultimately, that's the CA problem, not yours. If they are willing to give away certificates for free and Microsoft is OK with including their root key as a "trusted by default key" then there is no problem for you in using such certificates.

Edit: and now there is Let's Encrypt, which is a free CA that got accepted by major browsers. Their business plan is not suspicious -- in fact, they don't have a business plan at all. They operate as a non-profit entity and they live from donations. Their found a nice niche: they got buy-in from major browser vendors who went on a crusade to kill non-HTTPS Web, and needed a free certificate issuer to convince admins of small Web sites to switch; and now, no browser vendor may leave because it would make them look complacent with regards to security.


there is any port opening script or solution to increase security? I mean port is opened just when some port sequence detected on log In order to increase security, for example on ssh remote connections, I:

open a non stardard port.
use mandatory digital certificates for authentication.
allow connection from a ip range only.

But I wonder if this is enough to protect my ssh remote access. I was wondering if there is any script or solution doing this:

listen on syslog and filter ssh access intents.
if a predefined ports sequence is detected, then open for some minutes your non standard ssh port, then close it again if there is no active session.

So this is a "ports key" implementation. Do you know if a similar solution exists? Do you think such a tool is interesting to increase security levels?

Here is an article about port-knocking: https://www.digitalocean.com/community/tutorials/how-to-use-port-knocking-to-hide-your-ssh-daemon-from-attackers-on-ubuntu

And as schroeder said above - this is security by obscurity, it does not make your system more secure. If you are looking for securing your box and still need access to it from any IP address, consider using VPN with SSL certificates to authenticate against the system and then connect to your SSH server. Otherwise just allow access to your SSH from a range of trusted IPs.


Storing Bob encrypted data, and send them to Alice (who must be able to decrypt the content) I need to develop a website where a user (Bob) send text, image, or video content to my website. After some time, I need to send this data to another user of his choice (Alice).
I want to encrypt user data before storing them on my website to preserve user privacy. I don't want to be able to decrypt these files/store the key.
But is there a way to do this? Bob will have had no contact with Alice, so in my eyes it's complicated.

Option A:

Bob uploads data to your site. It is stored encrypted with a key only known by Bob.
After some days/months, you notify Alice that there's some data to be received. Alice registers on your website (generating a public key).
Bob authorizes Alice account to read the data (uses their public to encrypt the secret from step 1).
The actual data can now be received by Alice.

Drawbacks:

Bob needs to trust that the account registered by Alice is actually owned by his dear Alice, not by e.g. an imposter from your company.
Bob needs to authorize Alice account (give her the key) after she registered.

Option B:

Bob uploads his data to your site. You provide Bob a link to download, containing the key.
Days/months later, Bob sends the link to Alice.

Drawbacks:

Bob itself needs to send that link to Alice. Or someone else on behalf of Bob e.g. he could program an email to be sent in 3 months (if supported by his provider).
Anyone in possession of that link could access the data. This could be easily solved by having your site verify Alice identity (you check that the access is performed by Alice and she needs the link for decryption).

If Alice already had an encryption key (such as a PGP key), that could be used directly, but it is unlikely that a normal user has one.


Are there any sequences other than ../ which will be intepreted as directory traversal in *nix or Windows? A common vulnerability is for web applications to accept a filesystem path as a request parameter, and then perform some action on the specified path.  For example, retrieving a file and returning it to the user, or perhaps even writing/deleting a file.  This can allow malicious users to access files they're not supposed to be able to access, such as source code, password files, etc.

This can be a problem even if you prepend a base path, because an attacker can use directory traversal sequences like ../ (*nix) and ..\ (Windows) to traverse up out of the base path and into restricted directories and files.

The general idea then, is to either outright ban any such traversal sequences, or to "normalize" paths containing these sequences and then check that they still fall within the base path.

From what I understand, trying to blacklist traversal sequences in the request parameter is difficult, because there are alternate URL and Unicode encodings (e.g. %2e%2e%2f, and many, many others) that may end up being interpreted by the web server as ../ or ..\.

However, are alternate encodings still a problem if we normalize the path after it has been received by the web server (e.g., Apache) and passed to my application?  For example, using these normalization rules?

My reasoning is that, whether the web server receives %2e%2e%2f and decodes it to ../, or the web server directly receives ../, the normalization algorithm will see ../ and resolve/filter it before checking against the base directory.  Even if an attacker uses a double-encoding like %252e%252e%252f, it will be decoded as %2e%2e%2f, which will be treated literally by the OS/file system.

However, in this question, it suggests that:

  However, if a web server is serving files and decoding the unicode is done after the check that prevents directory traversal or done slightly differently by the operating system, this attack may get past the filter allowing the attack to work.

So in other words, are there any known sequences of characters that could make it past the web server's decoding AND the aforementioned normalization routine (which handles ../ or ..\), that could be interpreted by the OS or lower-level file handling functions as directory traversal?

For example, in PHP:

$base = "/path/to/allowed/directory/";
$path = $_GET['path'];

$normalizedPath = normalize($path);   // normalize will remove or resolve ../ and ..\
$fullPath = $base . $normalizedPath;

echo file_get_contents($fullPath);

Utilizing Unicode, it's possible to encode \ and / into multi-byte characters. If the string comparison functions are not unicode-aware, there could be a bug which allows these characters through.
Wikipedia has a section on this in relation to an old attack on Windows servers:

When Microsoft added Unicode support to their Web server, a new way of encoding ../ was introduced into their code, causing their attempts at directory traversal prevention to be circumvented.
Multiple percent encodings, such as

%c1%1c
%c0%af

translated into / or \ characters.

Technically this is still using the slash character when it comes to the directory traversal, it's just not the true single-byte character which may confuse some code.
I believe the best advice for avoiding such characters would be to disallow any characters for file system paths except a safe subset of ASCII characters. You can also sidestep other issues of allowed characters in some operating systems and file systems at the same time.


How can I detect and block bots? For example, if I am on stackoverflow and I refresh my page several times in a row, it starts to think I am a bot and blocks me.

How can I build something like this into my own site?

Use Roboo: http://www.ecl-labs.org/2011/03/17/roboo-http-mitigator.html

Demoed at Blackhat in 2011. Very effective and easy to get up and running. I would recommend over any use of CAPTCHA

"Roboo uses advanced non-interactive HTTP challenge/response mechanisms to detect and subsequently mitigate HTTP robots, by verifying the existence of HTTP, HTML, DOM, Javascript and Flash stacks at the client side.

Such deep level of verification weeds out the larger percentage of HTTP robots which do not use real browsers or implement full browser stacks, resulting in the mitigation of various web threats:

HTTP Denial of Service tools - e.g. Low Orbit Ion Cannon
Vulnerability Scanning - e.g. Acunetix Web Vulnerability Scanner, Metasploit Pro, Nessus
Web exploits
Automatic comment posters/comment spam as a replacement of conventional CAPTCHA methods
Spiders, Crawlers and other robotic evil"

Also good measure against DDOS: http://www.rakkhis.com/2011/03/ddos-protection-strategies.html


Least insecure way to encrypt a field in the database so that it can still be included in queries I have a table where all columns need to be encrypted (aside from the PK). This will be achieved using AES at the application level. However there is one particular field that needs to remain searchable.

For example a Message table has:

MessageTitle  (Encrypted)
MessageBody (Encrypted)
SenderID (Encrypted but matchable)

Given a plainText SenderID I should be able to select all the related messages.

A few constraints / decisions:

I do need to encrypt the data at rest, including this column. I have no choice.
The SenderID is of a fixed format, so if I hashed the value it wouldn't be hard to brute force
I have chosen to encrypt specific fields rather than the whole database (TDE) to mitigate threats other than just the disks being stolen.

Currently my preferred solution is to encrypt the SenderID (and only the SenderID) with a fixed IV. This way the data remains encrypted but we can still match on it in queries.

A downside to this approach is that plaintext attacks could occur on the data; DBAs could create records with different SenderIDs and try to find a matching record. However I feel this can be mitigated at the Encryption Service with suitable access control and monitoring.

Does this seem like a valid solution?

Given what you've told us, I would still use a hash function: that's exactly what they have been designed for.

You cannot salt your hash value, unfortunately, since you want to be able to find a specific record based only on the cleartext value but you can still used a HMAC algorythm to protect against direct attacks: an attacker will need to have access to the key used in the HMAC computation in order to derive a hash from a given cleartext: assuming you're storing your keys properly (probably the most critical issue in such an application), your SenderID will remain hidden but you'll be able to find it at any time by a simple lookup.

Using a HMAC will also help you if your SenderID has low entropy (although it will not solve THAT issue completely).

Please note that anyone who has (or can gain) access to the key used in your HMAC calculation will be able to try to match given cleartext with your data but that is something that cannot be helped, I think.

Be aware, though, that, while you can (and should) have a different key on each installation, you will NOT be able to change that key afterward or you will lose the ability to find your records. One way around this is to add an encrpyted version of the SenderID within your record: in you need to re-key everything, you can use it to recompute a new hash.

I would, however, suggest that you use a strong, modern hash function for your HMAC. (SHA-3, for instance, even if the final specs haven't been published yet)


Programmatically Quarantining files Situation: Using Python to make a simple quarantine software for malware.

What I know:

I do understand (from this forum no less) that one of the ways is to put the file in a quarantine directory and turn off all access to it (i.e. 0000 Linux file permissions).

Another way is to scramble the binary such that it cannot be executed when "double clicked", but can be unscrambled should the user decides that the file is safe and wants it back.

Problem: I am not convinced that quarantining files are just as simple as that.

Question: What are some other ways that antiviruses use to quarantine files that I can use?

Additional information: Do avoid proprietary methods, as this method will be deployed in my code.

Let me explain a mechanism that we used on the past on a commercial AV that I was working on:

The AV engine detects the malware.
We create a new file with a header with meta information (timestamp, malware name, sha of the file, and so on) and after the header the original file. By doing this, we didn't care about the permissions of the file and by executing accidentally or things like that.

This was working for us and might give you an idea of what you can do in your implementation.


Do I need to set maximum characters length for password using bcrypt? I using bcrypt to create a password hash and in the php documentation it says

  Caution: Using the PASSWORD_BCRYPT for the algo parameter, will result
  in the password parameter being truncated to a maximum length of 72
  characters.

If I allow users to type more than 72 characters it's like I fooling them because they not using the passsword that they think that they use. So my question is do I need to set maximum length or not

Well Dmitry is right when he says 72 characters is good. If the characters are random enough. (1.78 bits per character).

You can use the approach described (security warning that password is "too long"). Or simply limit password length (with security warning).

If you expect your users to enter more than 72 characters, you could as well use SHA-512 to prehash the password, so you'd feed the hash into the bcrypt (as password) and not the actual password. There are no security issues with this approach. However it is non-standard, so if you do need to provide interopability with other applications (not yours) you can't use it.


IP over HTTP GET only Consider the following scenario: There is a client behind a really strict firewall. There is nearly nothing available to 'connect to the internet'. Just DNS resolution and HTTP/HTTPS (some whitelisted sites like Google can be visited; others get redirected to the 'site was blocked' page).

So the idea was to to build some kind of proxy using only http get requests (using this service from google as proxy which works fine but lacks css/http post request support)

Do you think that's possible or are aware of software that's capable of doing this? Or maybe another way to accomplish unrestricted internet access under these cirumstances?

PS: Using DNS for tunneling all the traffic works but is of course really really slow.

Do you think that's possible or are aware of software that's capable of doing this? Or maybe another way to accomplish unrestricted internet access under these cirumstances?

If you are in control of a server reachable by the service you mentioned then you could built your own tunnel, because

you can send data through the tunnel to the server (via the URL of the request)
and you can receive data through the tunnel from the server (via the response)

Which means all you have to do is write yourself the appropriate local and remote handlers to translate between your tunnel protocol and HTTP request/response.

I'm not aware of any existing software working within your specific restrictions (httptunnel is probably outside your restrictions), but it is possible to write something like this and to help you to actually circumvent specific security policies would be outside the scope of this forum anyway.

And always remember that security policies are often there to protect something and that you might get into trouble when you try to circumvent these policies, like loosing the job or maybe even get charged for hacking attempts. And such tunnels can be detected because they show abnormal usage behavior.


ROP Attack :Force the program to manipulate an instruction as a gadget I'm doing basic exploitation test on a simple program with fiew lines of code. I intend to exploit a buffer overflow vulnerability to perform a ROP attack.
To gather the available gadgets I use ROPgadget tool.
I found a very useful gadget at address let's say addr, this address is the start of another legitimate instruction for the program.

Is it possible to use this gadget or not? If yes, how will the processor execute the gadget and not the legitimate instruction knowing that they both start at the same address addr

Short answer: yes.

Long answer:

Instructions on x86 processors vary in their length between 1 and many bytes.
(This works because no instruction can be a prefix of another instruction. Much like phone numbers. See this guy for the theory behind it.)

The CPU sees everything as bytes and does not know what the compiler intended, so if you point the instruction pointer at some executable memory, the CPU does not care as long as it decodes to a valid instruction. It will then continue executing until it encounters any kind of error.

Example:

  89 EB FE 40 C3

If you jump at the first byte you get:

  89 EB FE 40 C3 : mov EAX, 0xC340FEEB

If you jump at the second byte, you get:

  EB FE : jmp $, endless loop, will spin forever

If you jump at the third byte, you get:

  FE 40 C3: INC BYTE [EAX-0x30]

If you jump at the fourth byte, you get:

  40: INC EAX
  C3: RET

Look, a ROP gadget!
It increments EAX then returns.

Which is the "real" instruction the programmer intended? Who cares?

This whole concept is what makes ROP so easy on x86 processors. E.g. MIPS, where you cannot jump in the middle of instructions, it´s much harder to find good gadgets.


Is this an attempted cross-site attack? I have found various 404 errors in my web server log that look like this:

http://mywebsite.com/go.php?http://pastebin.com/raw.php?i=ffdkafkjasd
http://mywebsite.com/go?http://pastebin.com/raw.php?i=ffdkafkjasd
http://mywebsite.com/raw.php?http://pastebin.com/raw.php?i=ffdkafkjasd

None of these URLs have ever existed (my website is not even PHP-based). It looks like someone is attempting to guess a URL for a page on my website which causes a browser redirect to pastebin.com.

What is this person trying to do? Is it some sort of attempted hack?

A script or bot is probably probing for an Unvalidated Redirects and Forwards vulnerability.

The reason I say this over SSRF is because the target domain is pastbin.com, and not a domain under control of the attacker. The attacker will have no way of knowing if a SSRF attack worked without validating that the server-side request was made, therefore this is unlikely.

However, with Unvalidated Redirects and Forwards the attacker just needs to look for a redirect HTTP response such as 301 Permanent. If successful, they could then use your site in a phishing style attack using an obfuscated redirect domain (say percent encoded) in the hope their victim follows the link to your (trusted) domain.


How to properly manage encryption key To encrypt the database in the organization, I think it is better to use symmetric key encryption.

According to what I've researched from NIST paper.

  Cryptoperiod: The originator-usage period recommended for the encryption of large
  volumes of information over a short period of time (e.g., for link encryption) is on the
  order of a day or a week. An encryption key used to encrypt smaller volumes of
  information might have an originator-usage period of up to two years. A maximum
  recipient-usage period of three years beyond the end of the originator-usage period is
  recommended.

but I couldn't find information on how to manage key in such a way that once the originator-usage period has expired, the database can still get decrypted as the recipient-usage period is longer. I don't really get the concept here since it is "symmetric" encryption key, how is it possible make it become decryptable but not encryptable. Could anyone explain or provide me with a resource of information? Thank you in advance.

I couldn't find information on how to manage key in such a way that
  once the originator-usage period has expired, the database can still
  get decrypted as the recipient-usage period is longer.

Quite simply, when they say "usage period", they mean "period during which you will use the key this way."  They are not suggesting that you alter the key, only the way you use it.

To quote NIST SP 800-57 "Recommendation for Key Management"

  A symmetric key shall not be used to provide protection after the
  end of the originator-usage period

They are not asking you to destroy the key, merely to stop using it to encrypt data at the end of the OUP.  You will also need to stop using the key to decrypt data at the end of the RUP, which implies that by the end of the RUP you have re-encrypted any data with a newer key which you will use instead.


Can certificate signing requests be stored at the server to prolong existing certificates? I want to build a PKI (public key infrastructure) to host certificates for users.

My use case is, that I want to use the certificates for e2e encryption between the users.

Users must be able to download valid certificates for a random user. (sharing is initiated by the sender)
Certificates must still be valid, even if the receiver did not log in for a long time. (in theory months, years)

For that to work,

the user has to send me a CSR (certificate signing request)
I have to check the CSR for validity
I create the certificate with the CSR and my intermediate signing certificate

Now I want to prolong the existing certificate. For that I could store the CSR in the database and just repeat step 3.

Is this a good idea? (I have the feeling that it is not, but I cannot pinpoint the exact issue with this.)
If not, what are good and reliable alternatives? (e.g. I want to keep the certificate valid, even if the user does not log in for a longer time)

A CSR contains essentially the same information which end up in the final certificate, although the CA will likely add some additional information and might decide to ignore some information from the CSR. Specifically the CSR does not contain the private key for the certificate. Given that it should be no problem if the CA stores the CSR.


How to interpet RFC data format I'm having slight problems reading the used format in an Internet-Draft: TokenBindingProtocol#Section6

here

enum {
   provided_token_binding(0), referred_token_binding(1), (255)
} TokenBindingType;

im not sure what the 255 stands for. I assume that these enum values are in the range from 0...255 i.e. represented by an 8 bit value?

struct {
    TokenBindingID tokenbindingid;
    opaque signature<0..2^16-1>;
    Extension extensions<0..2^16-1>;
} TokenBinding;

here its absolutely not clear how to interpet the <0..2^16-1> suffix.
I think it is some kind of size indicator, i.e. the value of signature can have a maximum length of 2^16-1 but am not sure... Also for the extensions field which references the struct Extension it's unclear. In my eyes it could mean the extensions field references 0 up to 2^16-1 extensions, or the sum of all extension data is up to 2^16-1

Also I could not find any document explaining this format. Is it like well known pseudo-code or are there any resources?

It is a vector of specified size. I think everything you needed is documented here.


Is UPnP still insecure? In today's world, on equipment that is properly updated to the latest software/firmware, is UPnP still insecure, or have its vulnerabilities been fixed?

Why is/was UPnP insecure anyway?

UPnP's bad name comes from implementation issues found in 2011-2013. It's like saying email is insecure and should be disabled because someone found a common issue in multiple email clients some years ago.

I always disabled UPnP because everyone said so. Now that I looked into it, it turns out to be silly. When UPnP was new, some devices were found to allow configuration from the Internet. Anyone could open any port on it. Since then, router vendors had plenty of time to fix their software. Security is a much bigger thing now than it was in 2011 (that's about the time when the first iPad was released), so vendors are more aware of security issues. For older routers, if they were vulnerable in the first place, a firmware update has probably been released long ago.

What is the purpose of UPnP?

UPnP is a solution to an issue that is created by having too few IP addresses. Because not everyone can have their own, we need to share them. The way we do this is by Network Address Translation (NAT): your consumer router translates between your local network (for example 192.168.x.x) and your public IP address (for example 278.14.1.48). Peer to peer applications such as file sharing, calling or video calling, distributing updates (Windows, Google Play), anonymity networks, resilient mesh networks, etc. all cannot function through NAT, so we have to either disable it for specific applications (using port forwarding), or find workarounds (such as UDP/TCP hole punching, STUN, etc.). The UPnP protocol is what an application uses to tell the router that it would like to disable NAT for an application. It's basically automatic port forwarding.

Not enabling UPnP means we need workarounds instead of being able to have peer to peer communication. Software developers that hope to make a profit off of you will spend money on running servers to keep those workarounds functional for you, but free software often does not have such luxuries and cannot function without either UPnP, or you forwarding the port manually.

Then why are the others saying "Yes, it's insecure by design"?

(Spoiler: they are wrong.)

Because NAT is ubiquitous in IPv4, many people started to rely on it for security: because you cannot reach individual hosts inside the network, vulnerabilities cannot be exploited from the outside, and people started turning off security measures inside their LAN. They neglected doing security updates and opened file shares without passwords (because nobody ever takes their laptop outside their LAN, right?), so now you need a firewall that is outside of your laptop, for example in your router. Combine this with the idea that UPnP can open ports, and you get misinformed answers such as the previously top-voted answer.

Ask yourself: what makes that UPnP request to your router to open a port? It has to be something inside your network. For example, malware could tell the router to open it. How terrible! But wait, if you have malware running on your network, and your laptop is not secure... then you are already screwed right? Yes, indeed.

Malware does not need UPnP to reach your local devices: for it to be able to do UPnP, it already needs to be on your device, or inside your network, so it can reach the internal devices by itself without using UPnP.

Or what if a friend brings their smartphone that is infected with malware? It could tell the router to do UPnP to your other devices and expose them. True enough, but again: the malware is already inside your network and can already reach your local devices directly.

Conclusion

UPnP is fine to enable if your router is not ancient, or if you installed firmware updates for it (or if it was never vulnerable in the first place).

Even if your router is known to be vulnerable (and you either refuse to install the update or the vendor did not release an update), then it's still not an issue if all devices inside your network have their security updates installed. You should be doing that anyway, as every website that you visit can attack local devices through JavaScript in your browser (particularly if the local device can be exploited via blind HTTP requests), and everyone with access to your WiFi (e.g. through password cracking) could hack them as well. Beware: this includes printers, IP cameras, and other embedded computers that are often forgotten.


Scapy WPA2 packet forging Can I use scapy to forge custom packets on WPA2 network? Can I even pack the IEEE 802.11 headers?

There are several dot11 classes that are declared to help with low network layers.  However, based on their less than adequate documentation that WEP is the only secure protocol that is somewhat supported.  Scapy's manual shows some WiFi sniffing, but doesn't really delve too much into Wireless communication.

All-in-all you'd probably have to hack together a mixed solution of raw data, and some of their classes to do what you want.  Not impossible, but not as easy as spoofing other protocols with Scapy.


PCI Compliant Key Management solutions that don't cost a fortune We are relatively small software company who has a requirement to store PAN's for our customers. Hosted payment solutions just don't fit our product requirements. We literally have 3 lines of encryption Code in C# which currently uses Ent Lib.

We have taken some consultancy from a very knowledgeable QSA and we have worked out how we are going to fundamentally re-architect our solution so that whole product doesn't fall under the scope of PCI compliance which would stop our ability to innovate.

I now have a shopping list and a very tight budget. The one item that is causing me a significant headache is PCI key management solution. HSM's are expensive and the equivalent software solutions are also surprisingly expensive. We consistently getting quotes in the region of £30,000 to £50,000 for something I would expect to be no more than £1000 per server plus free dev licences. We only require 2 servers with a luke warm standby to access the secure keys. It seems the letters PCI are adding zeros onto the price for something that conceptually not be that hard!

Is anyone using cost effective solution their QSA is happy with. I get the feeling the QSA's want the Rolls Royce/Ferrari when an entry level Mini would do for a lot of companies. I am happy to spend money and I guess I have reset my sights a little but something under £5000 would be a realistic budget for us.

One of the main difficulty with good key management is secure storage of encryption keys. If you look at what the NIST is saying on this subject (SP 800-57), you basically have three options:

Use HSM
Use physical security (put your key in a safe)
Store your key directly on the system, encrypted by a Key-Encryption-Key (this option is frequently used, but does not solve your problem, because your top KEK has to be securely stored as well !)

You already stated that HSMs are expensive so you still have the safe option. The main problem in this case is that your servers cannot get the key automatically when they need it, so you have to make sure that:

Your application needs to get the key only once (it is then stored in memory)
You can have someone type the key each time you boot your application

Obviously, you still have to define secure procedures for every aspect of the key management, but in certain cases, it can be a viable and cheap option.


What exploit types do I need to protect against in PHP? I recently learned that it is common for people to attempt SQL injections using the HTTP referrer in PHP. What other inputs do I need to protect against?

I am currently "cleaning up" incoming $_GET[] and $_POST[], and now the server's referrer. I am also removing HTML from things like user names, and of course before I do anything I am removing invalid UTF8. (At present I am not dealing with UTF7.)

There is a large number of vulnerabilities and attacks that impact the security of your application. You can start with a list of the most common and critical ones and OWASP Top 10 is the most popular resource containing detailed information and excellent cheat sheets for a quick start.

Vulnerabilities come from insecure development practices so here is the OWASP Secure Coding Practices Quick Reference Guide in a checklists format. Implementation of these practices will mitigate most common software vulnerabilities.

Your questions is about input validation which is only a part of the problem you are trying to solve. Securing your web application is not an exact science where a complete list of all possible issues and fixes can be defined and implemented.

But still, input validation is one of the most effective technical controls for application security. It can mitigate numerous vulnerabilities including cross-site scripting, various forms of injection, and some buffer overflows.

Variables used to acquire user-supplied in PHP:

$_GET
$HTTP_GET_VARS
$_POST
$HTTP_POST_VARS
$_COOKIE
$HTTP_COOKIE_VARS
$_REQUEST
$_FILES
$HTTP_POST_FILES
$_SERVER[‘REQUEST_METHOD’]
$_SERVER[‘QUERY_STRING’]
$_SERVER[‘REQUEST_URI’]
$_SERVER[‘HTTP_ACCEPT’]
$_SERVER[‘HTTP_ACCEPT_CHARSET’]
$_SERVER[‘HTTP_ACCEPT_ENCODING’]
$_SERVER[‘HTTP_ACCEPT_LANGUAGE’]
$_SERVER[‘HTTP_CONNECTION’]
$_SERVER[‘HTTP_HOST’]
$_SERVER[‘HTTP_REFERER’]
$_SERVER[‘HTTP_USER_AGENT’]
$_SERVER[‘PHP_SELF’]


Allow only YouTube videos and block other videos I have a MikroTik router. I want to allow only Youtube videos and block all other videos. I tried to write an extended ACL but I really have no idea. Maybe allow only Youtube videos source URL and block other URLs? Can you guys help me?

As Far As I know, you have 3 choices:

You can use URL filtering by allowing "youtube" or any URLs in the MikroTik firewall in the layer7 protocol field and deny the other specifically or deny all as that link shows.
You can use content filtering to block Adult WebSites in your MikroTik.
You can use proxy servers such as Squid for URL filtering.

There is also another solution that may help you, you can monitor your network NetFlow Traffic and find out what is exactly going on, on your network and based on that you can provide a good and suitable solution for issue.


How to implement 2FA without user phone I have a problem: users share their credentials with other users.
I have to create a way to ensure that users are using their own credentials to access the system. I think creating a 2 factor authentication, but I can not use the user's phone. Does anyone know a way to do this through software and not hardware (like biometric device)?

There is a detail that discards solutions about educating users. Some users have reported that their credentials have been stolen and used by former officials, and unfortunately we had a real case with this situation.

2-factor logins consist of 2 of three things: something you either have, are, or know.  Passwords are something known, so you'd have to implement something you are or have.  Biometrics, ie  "measuring people"; iris scanners, fingerprint scanners, voiceprints, hand scanners, and facial recognition are examples of biometrics that either require specialized equipment, or can easily be fooled by someone with access to a dollar store. So unless you have a human supervising them, biometrics are out.

So that leaves something you have.

A simple and annoying way to do this is to restrict user logins to their computer.  Sure, you know Bob's password, but you don't have his computer.  So login fails.  That's about the cheapest way t o do it.  Otherwise you can issue hardware tokens.  Then you'd enter your password and the code from the hardware token or have the hardware token inserted into the USB port.

The challenge to doing this via software is having it be something you have or are.  Software by definition is generally neither of them.

PS you already know this, but you have a huge problem with people sharing passwords.  Effectively you have no audit trail or way to specifically hold someone accountable for what was done under their login.  I assume you already knew that...


Incident response and recovery from a security breach with unknown attack vector Security breaches, hacks, “cyber” attacks or server compromises happen quite frequently, unfortunately, such as Quora in December 2018, Facebook in September 2018, Equifax in September 2017, Exactis in June 2018, MyFitnessPal in March 2018, and thousands of others.

With regulations that dictate mandatory breach notifications, such as the GDPR, we can expect that the number of cases will continue to grow. Moreover, it’s likely that there are tons of cases that are simply unknown to the public, have been unreported, or even undetected by the companies themselves.

Yet to my surprise, what I never hear about is a company going offline for a while because they are still investigating and haven’t yet found out how the attackers got in, or a company falling victim to another attack again within a few days or weeks.

(That is, except from some rare cases, of course. Though preventing another (spear) phishing attack is, of course, not something you can just apply a patch for, it’s a process.)

There may be compromises following attack vectors which are hard to detect, e.g. rowhammer, spectre, certain zero-days, an infected package manager opening reverse shells, etc. If attackers got access to a company’s network by using credentials they obtained from a phishing attack against an employee, and they cleaned up their traces and deleted logs, it might be imaginable that neither a company nor their forensic advisors are able to detect how the attack succeeded.

  Do NOT put the affected systems back online until this stage is fully complete [...] Examine the 'attacked' systems to understand how the attacks succeeded in compromising your security. Make every effort to find out where the attacks "came from" [...]

  – Rob Moir

We should expect some companies to go offline for a few hours while they do their analysis and recovery, some for a few days, and some never coming back online, shouldn’t we?

Are all companies, even those with horrific vulnerabilities, excellent at intrusion detection and forensic analysis, or did I just miss something?

You are viewing this from a security perspective and (I assume) from the perspective of a security practitioner. Assuming the company is in the business of making money, they will shut down the bare minimum required time because it will affect profits. IT will seldom have much input into whether or not they can remain offline while doing root cause analysis. Hell, most of the breach investigations I've been involved in, the systems are simply restored from backups, no investigation is done into what happened until they've been hit for the umpteenth time in a few months, and we are given almost nothing to work with in finding the root cause. Management cares about dollars, and though processes may change with things like GDPR I doubt this will change too much, except more IT staff will be fired after a breach. As for your question about 'excellent intrusion detection' capabilities, these are generally lacking too. If you read through the Verizon Threat Report: http://www.verizonenterprise.com/industry/public_sector/docs/2018_dbir_public_sector.pdf on page 10 it gives a break down on 'discovery', and its generally in the months to detect a compromise.


To disconnect or not disconnect an intruder? Most of the time, when an intruder is detected, we would disconnect it at once. However there are certain cases where the intruder is not disconnected.

What are the benefits of not disconnecting the intruder? Can I say something like, some organizations would want to trace the intruder's identity and by not disconnecting the intruder, that is possible?

Knowing of an attacker and not disconnecting them will allow you gather evidence on the attacker such as determining the motive for the attack, determining the tools the attacker is using, determining the mode of operation of the attacker and maybe... just maybe, but not likely, being able to trace the connection back to the attacker. You could then try to use attribution to determine likely suspects.

Doing this could have legal and reputation implications. Imagine what Fox news will say on the air when they found out you allowed the attacker to have access to your network, compromising the confidentiality of company data. In my opinion, unless the attacker is currently in a honeypot that you all have deliberately setup, it's best to just disconnect them and look at the evidence you currently have.


How to report a phishing text? I received a text message on my phone the other day with an attachment link:

  Dear Customer, please contact us about your account   Call2bankofamerica

It's an obvious phishing attempt, and I would like to report it but to whom? I called Bank of America and fowarded the message to their abuse department, but now what?

Bank of America was not helpful, by the way. I would like to post it on the internet so people could google this info. This is the first time I've received anything like this and I would like to post a warning.

In the USA, you can report SMS phishing attempts to the US-CERT by forwarding them to 772-6; emailed phishing attempts can be reported to phishing-report@us-cert.gov.  See the US-CERT website for more details.

In other countries, you'll have to check with your own government.


How do big cloud providers guard against VM escape attacks? I think it's pretty much unassailable to say that cloud computing as we know it depends on the concept of the robustness of virtual machines. Where one can depend on the security of VMs they allow workloads from multiple customers of a cloud provider to securely run on shared hardware, while also guaranteeing that if the security of something inside one customer's VM is compromised the host OS & firmware of the provider's server won't be affected.  If you're Amazon, Microsoft, Google, IBM, or really any cloud provider of any size making sure VM isolation of each customer's stuff remains uncompromised is vital to your operations and to customers continuing to trust your service offerings.

However, as we know VMs are not escape-proof. Security vulnerabilities have been periodically found in every major virtual machine technology that I can think of.VENOM for Xen VMs is probably the most famous of these, but Hyper V, VMware products, and so on have also been afflicted by vulnerabilities. Of course, these known flaws can and are patched by providers. But there undoubtedly other flaws out there, waiting to be discovered and (potentially) exploited by attackers. In fact, one would assume that well-resourced attackers--meaning ones capable of developing new vulnerabilities & exploits in-house or buying valuable ones grey/dark markets--would have very strong incentive to devoting good amounts of time/effort/money to finding or buying novel ones that allow breaking out of the VMs used by major cloud providers. Especially given the ever increasing role that cloud computing plays in the tech infrastructure of so many companies & organizations that are, in turn, all potentially juicy targets (for varying reasons) to sophisticated attackers.

So, how do Amazon, Microsoft, etc. guard against the threat that a sophisticated attacker (whether state-sponsored APTs, high-end organized crime, or whatever) can develop for buy novel VM escape exploits and use them against the provider's infrastructure and customers? The one obvious measure that sticks out to me is running customized host-based intrusion detection systems on all cloud servers to try to catch VM escape events as/when they happen, but as we all know by now HIDS are hardly fool-proof. What other measures could/do cloud providers take to detect, prevent, or mitigate the danger of VM containment breaches?

Highly customized and patched hypervisors, sandboxes around said hypervisors to mitigate breakouts, and heavy monitoring. Of course, any given server only hosts so many VMs, so a breakout is fundamentally limited to a finite number of guests, if it's able to get past the protections outside the hypervisor. For example, QEMU can be compiled with a hardened toolchain, isolated using chroots, mode 2 seccomp, mandatory access controls. It can be patched to be made more secure, using custom seccomp filters, disabling excess code or features, adding custom, hardened drivers. Custom kernels can be configured and hardened to limit the ability of an escaped guest to compromise the kernel and escape mandatory access controls.

Unfortunately, the answer to the question can partially be answered with "they don't". Many cloud providers do regularly get compromised, they just don't know it, or don't disclose it. I see this happening periodically, and it's not pretty. Sometimes 0days are used, and sometimes little-known public issues with the providers are leveraged. For example, Amazon's higher end dedis not shutting down when switching customers, resulting in their GPUs not wiping VRAM, letting the next customer see what the previous one was doing (stealing secrets in OpenCL, anything which was sent over VNC or with X11 forwarding, etc). The Amazon security team knows about this, but still have not fixed it. They do not tell their customers this. This shows a lack of effort put into security, and a lack of awareness about extant security issues. With something like this which you'd think would become big news being known by few people, it's not surprising that large-scale or advanced attacks against cloud providers can happen without the general public being aware of it. The lack of awareness and news of attacks leads people to wonder how the hell these large businesses stay secure. They aren't.

To my left is a window with vim open. In it is code with a 0day on used recently to break out of a hypervisor on a certain medium-sized cloud provider. No protections were in place. All that happened was the exploit broke out and gained access to the host with the privileges the process the hypervisor was running as. No sandbox or extensive monitoring solutions were in place. A single obsolete syscall causing a kernel vulnerability lead to a compromised kernel and persistence in memory (grsecurity would have mitigated it, fwiw), and subsequent exfiltration of information. This company is worth hundreds of millions of dollars. I'm sure countless people have been in there before. Although this is not real evidence and just my own experience, it hopefully should show that cloud big cloud providers do not in fact guard against VM escapes well at all, with the exceptions mentioned in the first paragraph.


Is it bad practice to use the same password for multiple accounts on the same website? The argument I've heard against using the same password for two accounts on different websites is that if an attacker breaches one website and finds your password, they can then log in to your account on the other website.

However, if both of your accounts are on the same website, then theoretically if an attacker breaches that website, they can find both of your passwords, regardless of whether the passwords are different or not.

So is there an issue with using the same password in this situation?

If you consider a breach of the service and passwords are properly handled on the authenticating side, the attacker who gained access to the password database is left only with the brute-force attack.

Brute-force attack means checking exhaustively all possibilities, but does not limit the method to the dumbest "from 0000 to ZZZZ" one. That said, an attacker who expects users might create multiple accounts with the same password can easily modify the algorithm to check all accounts against each discovered password.

Whether this is an issue depends on you.

If you consider an attack on the client side, an attacker needs to learn one password from among multiple account-password pairs to learn all of them.

If you login to all accounts from the same machine, the attack surface remains constant, but if you use one account on a mobile device, the other on a secure PC, then one compromised device reveals the information about all accounts.

Again, given that you expressed the idea means other people think of it or do it too, and an attacker would probably take advantage of that (the cost is nil).

Whether this is an issue depends on you.