Can port numbers be detected from VPN traffic? When connecting to a remote server (e.g. via SSH) via a VPN, is the port-number used for the connection visible in traffic intercepted in between the client and VPN server?

Would connecting via Tor (instead/in-addition) help this?

(I'm mostly referring to OpenVPN here.)

  When connecting to a remote server (e.g. via SSH) via a VPN, is the port-number used for the connection visible in traffic intercepted in between the client and VPN server?

No. Your ISP, room mate, or any other possible man-in-the-middle between you and the VPN (without the ability to decrypt the traffic) doesn't know anything about your connections within the VPN tunnel. They don't know which ports you're connected to or whether you're using the tunnel for SSH or to browse the web.1

That is, all of the tunneled traffic between you and the server is TLS-encrypted and sent over a single TCP/UDP connection. An eavesdropper can only observe that, for instance, there is encrypted traffic over UDP between your port 12345 and the VPN's port 1194 and they may therefore deduce that you are using OpenVPN (and eventually identify the VPN provider by the server IP), but they don't know not what you are doing. The VPN provider however is obviously able to read (and log) your traffic.

  Would connecting via Tor (instead/in-addition) help this?

Yes, that would also work. If you tunneled your traffic through Tor you would similarly hide these connection details from a man-in-the-middle between your machine and the Tor network. However, they could tell that you're using Tor and the exit node would be able to inspect your tunneled traffic.

1Although they could try to find patterns in your traffic to get an idea what you might be doing.


Someone is trying to brute-force(?) my private mail server... very... slowly... and with changing IPs This has been going on for about 1-2 days now:

heinzi@guybrush:~$ less /var/log/mail.log | grep '^Nov 27 .* postfix/submission.* warning'
[...]
Nov 27 03:36:16 guybrush postfix/submission/smtpd[7523]: warning: hostname bd676a3d.virtua.com.br does not resolve to address 189.103.106.61
Nov 27 03:36:22 guybrush postfix/submission/smtpd[7523]: warning: unknown[189.103.106.61]: SASL PLAIN authentication failed:
Nov 27 03:36:28 guybrush postfix/submission/smtpd[7523]: warning: unknown[189.103.106.61]: SASL LOGIN authentication failed: VXNlcm5hbWU6
Nov 27 04:08:58 guybrush postfix/submission/smtpd[8714]: warning: hostname b3d2f64f.virtua.com.br does not resolve to address 179.210.246.79
Nov 27 04:09:03 guybrush postfix/submission/smtpd[8714]: warning: unknown[179.210.246.79]: SASL PLAIN authentication failed:
Nov 27 04:09:09 guybrush postfix/submission/smtpd[8714]: warning: unknown[179.210.246.79]: SASL LOGIN authentication failed: VXNlcm5hbWU6
Nov 27 05:20:11 guybrush postfix/submission/smtpd[10175]: warning: hostname b3d0600e.virtua.com.br does not resolve to address 179.208.96.14
Nov 27 05:20:16 guybrush postfix/submission/smtpd[10175]: warning: unknown[179.208.96.14]: SASL PLAIN authentication failed:
Nov 27 05:20:22 guybrush postfix/submission/smtpd[10175]: warning: unknown[179.208.96.14]: SASL LOGIN authentication failed: VXNlcm5hbWU6
Nov 27 06:42:43 guybrush postfix/submission/smtpd[12927]: warning: hostname b18d3903.virtua.com.br does not resolve to address 177.141.57.3
Nov 27 06:42:48 guybrush postfix/submission/smtpd[12927]: warning: unknown[177.141.57.3]: SASL PLAIN authentication failed:
Nov 27 06:42:54 guybrush postfix/submission/smtpd[12927]: warning: unknown[177.141.57.3]: SASL LOGIN authentication failed: VXNlcm5hbWU6
Nov 27 08:01:08 guybrush postfix/submission/smtpd[14161]: warning: hostname b3db68ad.virtua.com.br does not resolve to address 179.219.104.173
Nov 27 08:01:13 guybrush postfix/submission/smtpd[14161]: warning: unknown[179.219.104.173]: SASL PLAIN authentication failed:
Nov 27 08:01:19 guybrush postfix/submission/smtpd[14161]: warning: unknown[179.219.104.173]: SASL LOGIN authentication failed: VXNlcm5hbWU6

There is one single failed login attempt every 1-2 hours, always from the same domain, but every time from a different IP address. Thus, it won't trigger fail2ban and the logcheck messages are starting to annoy me. :-)

My questions:

What's the point of this kind of "attack"? The rate is much too slow to do any efficient brute-forcing, and I really doubt that someone would specifically target my tiny personal server.
Is there anything I can do against it except banning that provider's complete IP range? I could just stop worrying and add those messages to my logcheck ignore config (since my passwords are strong), but that might cause me to miss more serious attacks.

What's the point of this kind of "attack"? The rate is much too slow to do any efficient brute-forcing, and I really doubt that someone would specifically target my tiny personal server.

You may be seeing connections very rarely, but how do you know the bots doing the brute forcing aren't constantly saturating their uplinks, and your site is just one of many being attacked? There is no advantage for an attacker to spend a short time going after one site at a time (and triggering fail2ban), compared to attacking a huge number of servers at once, where each server only sees infrequent connections. Both can have the same total rate of outgoing authentication attempts per second, but attacking one site at a time is simply a less efficient use of the attacker's bandwidth.

Is there anything I can do against it except banning that provider's complete IP range (or ignoring the messages, since my passwords are strong)?

No, not really. Chances are, these are coming from a botnet or a cluster of low-cost VPSes. It is not possible to determine what other IP ranges may be being used just by seeing a few of these. If they are not on the same subnet, they cannot be predicted. You can safely ignore these connections. It is nothing more than the background noise of the internet. Just make sure you aren't low-hanging fruit.


Making 2 yubikeys generate the same password Is their a way you can make two yubikeys generate the exact same password at the exact same time? (identical copy) I am wanting to purchase two of them so I am able to store a backup yubikey in a secure location just in case I loose the main yubikey.

I am mainly interested in this for SSH keys and Keepass database's

If they were initialized with the same seed and had been through the same number of iterations, it's probably possible.

What you should be doing is registering the two different keys to the same account. Should you lose one, invalidate it.


XSS prevention through Content Security Policy How can Content Security Policy (CSP) significantly reduce the risk and impact of XSS attacks in modern browsers?

Is it possible to circumvent CSP in order to execute XSS?

Yes, CSP goes a long way to defending against XSS.  If you do a Google search on "Content Security Policy XSS" the first few links explain how and why.

If you're having trouble using Google, here are some good links to help explain how CSP defends against XSS:

An Introduction to Content Security Policy from Mike West
An Introduction to Content Security Policy from David Müller
Using Content Security Policy to Prevent Cross-Site Scripting (XSS) - SendSafely.com explains how they use CSP on their site.
The promises of Content Security Policy to secure the web

The CSP policy is enforced by the browser.  Therefore, assuming you have set a proper CSP policy, and assuming your browser doesn't have bugs, there is no way to bypass CSP.  That's one of the attractions of CSP.

Note that some browsers (e.g., IE10 and earlier versions of IE, if I recall correctly) don't support CSP.

Be warned that CSP is not a silver bullet:

CSP does not stop DOM-based XSS (also known as client-side XSS) if you enable 'unsafe-eval' in your CSP policy.  To prevent DOM-based XSS, you must write your Javascript carefully to avoid introducing such vulnerabilities.
CSP stops most forms of script injection, but it does not stop markup injection: see, e.g., Postcards from the post-XSS world as well as the HTML form injection attack from Section III-A of Self-Exfiltration: The Dangers of Browser-Enforced Information Flow Control
 (Chen et al, W2SP 2012).  So, you still will want to avoid introducing injection bugs into your code.

See also A few things beyond the scope of Content Security Policy for more discussion of some problems that CSP doesn't solve.


Spam GET And POST Requests - Are They Dangerous? I am getting a lot of spam GET and POST requests lately which some of them look like this:
"GET /config/getuser?index=0 HTTP/1.1" 404 143 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:76.0) Gecko/20100101 Firefox/76.0"

and:
"\x03\x00\x00/*\xE0\x00\x00\x00\x00\x00Cookie: mstshash=Administr" 400 173 "-" "-"

As far as I know these are trying known vulnerabilities in bulk but I am unsure.
So in my case where I only  have a single html file with nothing but text and a link in an up-to-date Debian server with NGINX, are they still pose a security threat? if yes how?
Thanks!

No vulnerabilities are typically not shared across different software or hardware platforms or even different versions of the affected software. What you posted appears to be a precursor or exploitation attempt for CVE-202-25078, a D-LINK router vulnerability. Typically any IP address on the internet receives a lot of nuisance traffic trying to collect information that once lived on that IP address, looking for proxy servers, guessing passwords or various exploits. Many of which come from botnets that take no care to determine if what they are targeting may in fact be something suitable to send the traffic to. This is normal internet background traffic and not a threat to your server.


Android forensics on Samsung Galaxy S7 edge's Voice Recorder I have a Samsung Galaxy S7 edge.

The default app that comes with the phone is called Voice Recorder and it belongs to Samsung, it cannot be uninstalled.

I recorded something highly sensitive that could protect me in a legal problem I had back in 2018, however the recording did not save. I am not sure if this was because the phone ran out of power, or without pressing anything some accidental hand gesture glitched the GUI so I could no longer press the buttons.

Since I did not explicitly hit the stop icon and then save the recording, where would this recording be in the phone?

Samsung Galaxy S7 edge.
Android version: 7.0.
Android security patch level: 1 January 2018.
The phone is not rooted.

I can update this with any additional information, feel free to ask.

P.S I have since installed another application that by default saves the recording to the phone by default, in case I forget to save in the future.

Thank you

If you have completed the recording and saved it then there are high chances to find it in the memory of your device using some data recovery utility/software (many available paid and free). These is also another linux distribution specifically made of Mobile forensics and pen testing named Santoku linux, You can try its data recovery and forensics tools to get back the recording. If you did not completed or saved even then you can try these tools but chances are low for recovery


Why is it possible for all programs / apps to see all network traffic? I am reading about sandboxing, specifically for Android and Linux based systems (like snap apps). Each app is isolated and can only see its own files, i.e. each app has its own environment. What I don't understand is why can each app see all network traffic being sent? On Android I can install HTTP Canary which works by being a VPN and then allows you to see all traffic sent from your device. On my PC I can use Wireshark and monitor all traffic sent from my computer.
My question is, why is this possible? Why do all programs have the ability to see all network traffic? Shouldn't true sandboxing result in only each app being able to see its own network traffic? I am thinking that it's because all programs have access to the network adapter, i.e. all programs should be able to use the network adapter, and thus each program can see everything that enters and exits the network adapter. Wouldn't it be better if some form of channels were used, so each app can only see its own channel in the network adapter? I know that as soon as the traffic leaves the device, every device nearby can monitor the wireless traffic, as it is in the air (it's encrypted however). However it's only before it leaves the network adapter that I don't understand, why all programs can see all traffic.

Sniffing network traffic is typically a privileged action. An unprivileged user does not have the ability to perform a packet capture by default.

You have outlined two scenarios (HTTP Canary and Wireshark) that require special privileges. In the first case, HTTP Canary must be explicitly enabled as a VPN by the device owner. An app cannot obtain this privilege on its own, and a user should not grant this privilege to an app that they do not trust to view all of their traffic.

In the second case, an unprivileged user cannot sniff using Wireshark without extra privileges. On Linux, this means being a member of the system "wireshark" group, or running it as root. On Windows, I believe this requires a driver installation that needs administrator privileges.

Since it requires extra privileges anyway, I don't think it really is a concern related to sandboxing. To conclude, packet sniffing is not something trivial that any application can do without acquiring special privileges. Even then, lots of traffic will not be visible since HTTPS is used almost universally.


Data extraction, temporary storage and audit log - Advice needed At work, we are planning to take down a database for 24 hours. We are not going down the track of creating a "Hot standby", the DB will be completely offline throughout. During the downtime, we would like limited access to some information from the DB. Management wants to extract this limited set of information and store it temporarily in an excel file. We have been asked to implement security around this. Can you provide some suggestions on how can we achieve the following during the downtime?

Avoid unauthorized access to the file containing the information.
Protect the Confidentiality and Integrity of the data.
Audit users accessing the file and the data.
Avoid copying or exporting the file.

You should create a mirror of the database. It's not possible to access data on the database when it's offline, so a mirror would make it possible, even a read-only mirror.

When you create a mirror, all the permissions, users and groups are exported too. This would solve issues 1, 2 and 3.

For 4, your application logs and database logs will suffice. You don't need to change anything, just keep the logs as you should been doing.

For 5, it's complicated. Database admins and server admins are in position to copy the entire database, and if it's not too large, take the data home on a USB disk without much trouble. This does not have to do with a temporary access, but even your production state must account for. Proper auditing will help, but not protect your data against a determined and resourceful admin. Just ask NSA about Snowden when you have time.


Multiple Passwords Appear to Log Into Single Account on Major Website I have a single account for a very popular website. I noticed that certain variations of my set password will successfully log me in. I have tested the variations on 3 separate browsers and all have the same behavior.

Is this a security flaw?
If so, what should I do with this information?

This is not a hypothetical question. I intentionally did not describe which variations successfully log in because it is a well-known website that many people use.

Is this a security flaw? Yes!

If so, what should I do with this information?

Contacting their IT department is a good idea. You want to give them time to patch the vulnerability (two weeks is the standard). If the IT department does not respond or fix the issue, then reach out to other people at the company; e.g., upper management. Reaching them by phone is probably the most efficient option, but I'd personally go the electronic route because documentation is important when it comes to such matters.

If, after all of this, still no action has been taken by them to fix this, you have the option of going public. This document should explain that you've tried to reach out to the company but your attempts went unnoticed. Some see going public as a social and ethical responsibility, but you should only do this as your last step. You'll want to contact them privately at first for reasons stated.

Here is some additional documentation that you should read before proceeding:

How to handle security issues of someone else's website
Found a security vulnerability, what should I do?
How to disclose a security vulnerability in an ethical fashion?


Is it safe to expose an SHA1 hash of an encryption key? Assume that party 1 and party 2 each possess a key used for AES encrypting data. Assume that the key was properly randomly generated and securely passed between them.

Now I need a way for party 1 to tell party 2 which stored key to use. I was thinking of simply creating an SHA1 hash of the key and sending that with the message. My reasoning is that party 2 can easily compare that hash with the hashes of all their stored keys but there is no way for an attacked to recover the key from only it's hash.

My requirements are protection from casual snooping, not protection from people with supercomputers trying to crack this individual message. Ideally I want the only information that party 1 and party 2 share about each other is the value of the secret encryption key.

Is this plan flawed in any way, and if so is there a better way?

Revealing the hash of the key may or may not be safe, depending on what you do with it. In your case, you have a key K, you show h(K) for some hash function (say SHA-1), and you also show e(K,M) for some encryption algorithm e (e.g. AES) and message M. This is safe only inasmuch as e is "different" from h, which is an ill-defined property.

For instance, imagine an encryption algorithm defined the following way: for message M and key K, hash K with SHA-1, then use the first 128 bits of the SHA-1 output with AES to process the message M. As far as encryption systems go, this one is rather good; it is as good as "raw AES" but it also accepts keys of arbitrary length. However, if you reveal SHA-1(K) then it becomes trivial to break it, even though you did not reveal K itself.

For what you want to do, you need some isolation layer between what you show for key indexation, and the encryption system. A hash function does not provide such an isolation layer "generically" between its input and its output because the output can be computed efficiently from the input (that's what the hash function is about). On the other hand, for a "good" hash function, there is no known way to compute half of the output by knowing just the other half; otherwise, fast attacks against preimage resistance would work. This yields the following scheme: from your key K, compute SHA-256(K). Split the 256-bit output into two 128-bit halves. Use the first half for indexing (you show it), and the second half for actual encryption.


Does GPG encryption via subkey harm file quality? If I were to encrypt a folder with music files or movie files, or even only the files themselves separately, would that hurt the quality of the files? For example, if I encrypted a lossless audio file, and decrypted it right after, would it lose quality or would it be the exact same file?

The idea behind encryption is that the original can be restored by decrypting again, that means that the process is lossless and thus the quality of the "file" is not harmed.


Typical 'search box' XSS attack When I develop a site, I'm always conscious of security flaws, but I'm struggling to see how a search box could ever be used to inject script that could be ran on a page of mine.

So I understand that, from a lack of sanitization, input may be added to my DOM. But - so what? I never expect a user to use javascript as a search term - so I'll never attempt to run it on my page. I'll treat it as a string, and so it will only ever behave like one. Or am I missing something fundamental here?

The only time I may add some input to the page is if I render No search results found for "<script>malicious();</script>", but I'll never let the search term run.

What am I misunderstanding here?

In fact, if anybody can explain aside from the search box concept - I'm happy with that. I'm struggling to grasp that last part of an XSS attack.

The goal of an XSS attack is for an attacker to somehow inject code into a webpage that is served from your site. This code is privileged in the sense that, as it was served by your site, the same origin policy lets it have full access to your site's cookies and the contents of the web page that you served.

So, if your site responds to a request such as

http://example.com/search?q=

by returning this HTML

No search results found for ""

then that script will be executed and you'll see the alert dialog. This is an XSS vulnerability. On the other hand, if your site returns:

No search results found for "&lt;script&gt;alert(1);&lt;/script&gt;"

Then you have, at least, some protection against XSS attacks.

In a real attack, the attacker would not use alert, but try to perform an action on your site as the logged-in user or steal data from the page or the user's cookies. You should read the OWASP XSS Cheat Sheet to get a more complete explanation as well as a detailed presentation of how to perform the appropriate escaping to prevent XSS vulnerabilities.


warftpd exploit, strange shellcode behaviour I am generating shellcode excluding bad chars using:

msfvenom -p windows/shell_bind_tcp -b '\x00\x40\x0a\x0d' -f py

No platform was selected, choosing Msf::Module::Platform::Windows from the payload
No Arch selected, selecting Arch: x86 from the payload
Found 10 compatible encoders
Attempting to encode payload with 1 iterations of x86/shikata_ga_nai
x86/shikata_ga_nai succeeded with size 355 (iteration=0)
x86/shikata_ga_nai chosen with final size 355
Payload size: 355 bytes

I increase the size of the stack to allow for decoding:

add esp, -1500

When I run the code and compare the shellcode in the debugger with the python code, all is well, the characters all match up.

The breakpoint in the EPI register is reached.

Then PUSH ESP and RET are called to point to the address of msvcrt.dll

I keep stepping through the shellcode (I checked this and all the characters are correct when compared to the hex python code):

ADD ESP, -5DC
MOV EAX, D5A109D9
FCMOVNBE ST, ST(3)
FSTENV (28-BYTE) PTR SS:[ESP-C]
POP EBX
SUB ECX,ECX
MOV CL,53
SUB EBX,-4
XOR DWORD PTR DS: [EBX+E],EAX ............. (Access violation when writing to [00000012])

At this point EBX = 00000004, EAX = D5A109D9

Why is the shellcode trying to write to [EBX+E]=00000012? Even the instructions after XOR DWORD have the correct hex characters that match with the code, hence there doesn't appear to be any other bad chars.

I solved the problem by stepping through and eliminating the bad characters one at a time where there was a crash. The bad characters causing the problem were:

pop ebx:                              \x5b
privileged instruction:               \x6c

(This was in addition to the null characters, carriage returns, and @ character)

Hope this saves somebody a lot of frustration


Choose your own exponents in RSA? In another interesting post, one of the developers/security researchers behind Phuctor suggests that using different exponents with RSA keys will "[increase] the costs of attacking your setup astronomically."

While the author does state that "it is not said nor implied here that there's any sort of theoretical vulnerability related to using 65537 as an exponent for RSA," this suggestion gets me thinking.

I have a few interrelated questions:

Is it possible to generate (PGP|SSH|SSL) RSA keys that use a different exponent?
Does a different, larger exponent increase the work effort required for an attacker? Does it increase the work effort required for legitimate uses?
If I generate keys with a different exponent, do I lose compatibility with certain systems? ie: if a system supports 2048bit RSA, will it likely also support 2048bit RSA with a different exponent?

Using a different exponent seems interesting to me, but people often have been compromised when they made a choice they didn't fully understand: even when they think they're adding security, they may be, in fact, diminishing it.

RSA itself, as specified in PKCS#1, does not mandate any specific value for the public exponent e. That value e must be relatively prime to both p-1 and q-1 (where p and q are the two factors that constitute the RSA modulus), but there is no other restriction. The exponent e does not even to be prime. It needs to be an odd integer, because p-1 and q-1 are even (since p and q are big primes, hence odd). The use of 65537 is just a widespread tradition. There is also an idea floating around that this specific value is somehow "more secure" than others (in particular using e = 3), but that's a myth. The most efficient public exponent is e = 3, though this impacts only public-key operations, which are extremely rarely the bottleneck in any given system.

In fact there is no relation whatsoever between that exponent and the attack cost. "Pratical" attacks methods for RSA try to factor the modulus, and completely disregard the public exponent value. The page you link to appears to want to use an exponent distinct of 65537 for the sole reason that some other people (that the page author does not like) recommend using 65537. This is a fascinating example of human psychology at work, but scientifically it has no value.

Generating a RSA key with an arbitrary public exponent is not harder, and most RSA libraries support it (command-line tools may be more limited). As for interoperability, you should be aware that some widespread RSA implementations, in particular the one in Windows (and thus used for SSL and for certificate validation), require the public exponent to fit on 32 bits -- not for enhanced or lowered security or whatever, but simply because it made life a bit easier for the original developer, who could devote a fixed-width small field for public exponent encoding. If you want to keep your interoperability, you should choose your public exponent in the 3 to 4294967295 range.


Netgear WNDR4000 open port 53 Why is port 53 open on the WAN side of the router? And more importantly how do I close it?
Port 53 is not one of my forwarded ports.

Discovered by doing

nmap -pT:1-64 <my-external-IP> -Pn

Output:

[...]
PORT   STATE SERVICE
53/tcp open  domain
[...]

How can I close that security hole? (see Listing of DNS vulnerabilities)

It's for DNS.  I'm going to go out on a limb and suggest you probably want to leave it that way.

http://www.networkworld.com/community/blog/allow-both-tcp-and-udp-port-53-your-dns-serve


Books about theoretical basis in log management I'm looking for a books about theoretical basis in log management, not about tools. I need it to write my master's thesis.

I need books about:

log sources, log collection
storage techniques, storing logs
log analysis (maybe statistical analysis, data mining)
analysis techniques
reviewing logs for potential problems, methods of reviewing logs
how to protect logs (remote logging, replication, write to cd)
what can we do with logs? (automated tasks, alerts)
maybe you will propose something?

I found:

"Logging and Log Management: The Authoritative Guide to Understanding the Concepts Surrounding Logging and Log Management" Anton Chuvakin; Kevin Schmidt; Chris Phillips
"Handbook of Research on Web Log Analysis" Bernard J. Jansen; Amanda Spink; Isak Taksa

but maybe you know others?

You can start learning about data mining here and if, you need a book, try this one.

For more on Machine learning you could go to
videolectures.net

A great introductory lecture on the site is Machine Learning, Probability and Graphical Models by Sam Roweis.

Next, you can have a look at Tom Mitchell's seminar The Discipline and Future of Machine Learning. Here is a direct link to the video [mov].
And the Syllabus page has a good list of recommended texts:

Neural Networks for Pattern Recognition by Christopher Bishop
Pattern Classification by Richard Duda et. al.
The Elements of Statistical Learning: Data Mining, Inference and Prediction by T.R. Hastie et. al.
Information Theory, Inference, and Learning Algorithms by David MacKay
Machine Learning by Tom Mitchell


What is the purpose of (ab)using the redirect page of my website for dubious URLs? My website has a redirect page with the format https://my.site/redirect?deeplink=https://foo.bar&...

The redirect is implemented in Javascript, so when you request the site, you get a 200 and some HTML + JS, not a 30X.

I recently started to notice that someone is abusing the redirect page for dubious links (guns, viagra, ...). It was suspicious that the traffic of the page increased by a lot, especially at night, when there should be barely any traffic.

I started to log the requests including referer. The referers seem to be all kinds of different hosts (not the same one every time) but mostly redirect pages themselves. Examples are

http://foo1.bar/cgi/mt4/mt4i.cgi?cat=12&mode=redirect&ref_eid=3231&url=http://my.site/redirect...
http://foo2.bar/modules/wordpress/wp-ktai.php?view=redir&url=http://my.site/redirect...
http://www.foo3.bar/core.php?p=books&l=en&do=show&tag=2774&id=20536&backlink=http://my.site/redirect...
http://www.google.sk/url?sa=t&rct=j&q=&esrc=s&source=web&cd=172&ved=0CCMQFjABOKoB&url=http://my.site/redirect...

I'm actually in control of the URLs that users should be legitimately redirected to, so I implemented a whitelist of valid hosts and started redirecting invalid ones to my start page.

What I'm wondering is, why should someone abuse my redirect page in the described way? And are there any risks I should be aware of?

Assuming that people trust your site, abusing redirections like this can help avoid spam filters or other automated filtering on forums/comment forms/etc. by appearing to link to pages on your site. Very few people will click on a link to https://evilphishingsite.example.com, but they might click on https://catphotos.example.com?redirect=https://evilphishingsite.example.com, especially if it was formatted as https://catphotos.example.com to hide the redirection from casual inspection - even if you look in the status bar while hovering over that, it starts with a reasonable looking string.

The main risks are to your site reputation (it's more likely to get black listed by filtering services if they spot dubious traffic being accessed through it) and to people following these links (who knows what is actually on the other site you're sending them to). It's unlikely to result in compromise of your server directly.


When does one need to be concerned with leaking timing information in .NET? According to this post, Dominick Baier was comparing two HMACSHA256 signatures and was leaking timing information upon an unsuccessful comparison.

When working with .NET crypto classes, when should one adopt a similar approach, and sleep for a random amount of time?  What amount of time is sufficient?

[MethodImpl(MethodImplOptions.NoOptimization)]
public static bool IsEqual(string s1, string s2)
{
    if (s1 == null && s2 == null)
    {
        return true;
    }

    if (s1 == null || s2 == null)
    {
        return false;
    }

    if (s1.Length != s2.Length)
    {
        return false;
    }

    var s1chars = s1.ToCharArray();
    var s2chars = s2.ToCharArray();

    int hits = 0;
    for (int i = 0; i < s1.Length; i++)
    {
        if (s1chars[i].Equals(s2chars[i]))
        {
            hits += 2;
        }
        else
        {
            hits += 1;
        }
    }

    bool same = (hits == s1.Length * 2);

    if (!same)
    {
        var rnd = new CryptoRandom();
        Thread.Sleep(rnd.Next(0, 10));
    }

    return same;
}

Sleeping a random amount of time doesn't totally stop the information leak: if the attack can be repeated, the random part will average out to a constant. Instead, you should make sure that the operation always takes the same amount of time.


Remove malicious rootkits and spyware from HDDs and SSDs I have read at least twenty articles dating from the time Edward Snowden's startling revelations about rogue nations and bad actors embedding malicious rootkits and spyware in the firmware of hard disk drives and solid state drives. What they did not mention is how to remove them.

There are some articles on the internet that mention the use of ATA Secure Erase/Enhanced Secure Erase feature in Linux's hdparm for the job.

I would appreciate it if you could point out if my understanding of the following issues is correct:

Disabling Host Protected Area (HPA) and resetting Device Configuration Overlay (DCO) to factory defaults will remove any existing malware/spyware embedded in the firmware of an HDD/SSD
HDD/SSD will not be bricked (that is, rendered unusable) if HPA is disabled and DCO is reset

No, the HPA and the DCO simply limit the size that the apparent drive size.  The DCO could be used to standardize drive size in a company wide deployment where the drives are source from multiple vendors.  A HPA is accessible by software which is "HPA Aware".  Neither of these are where firmware malware would exist.

The firmware is is a completely different storage, a different chip entirely from the main block storage that you see on a normal Hard Disk or SSD.  The firmware is able to be read, and flashed (not edited, but completely overwritten) using a special utility completely unique to the specific manufacturer, chipset (vendor and version).

The firmware of a SSD (and USBs for that mater) acts as it's own computer, with a processor, memory, and storage for the firmware.  The firmware handles wearleveling, reading, and storing data.  A malicious firmware could simply lie and say it was overwritten and you would be none the wiser.  A more complicated firmware would also need to dump a fake 'untampered' firmware if it was read using the special utility.

In summary, no.  You're not correct, there's no 100% way to prove a devices firmware isn't compromised, without taking the chip off the device and forensically dumping the firmware directly from the chip.


Secure flag not set to Cookies in .Net MVC application I have included the below lines of codes in my Web.Config and Glbal.asax.cs files, but still when I use developer tools in the browser I the secure flags were not set for the below cookies. Also Configured SSLSettings in my IIS (selected checkbox requireSSL).

I would like to set the secure attribute to all cookies, not only to received but also to sent cookies.

In Web.config:

<httpCookies requireSSL="true"/>

In Global.asax.cs:

protected void Application_EndRequest(object sender, EventArgs e)
        {
            if (Request.IsSecureConnection == true && HttpContext.Current.Request.Url.Scheme == "https")
            {
                Request.Cookies["ASP.NET_SessionID"].Secure = true;
                if (Request.Cookies.Count > 0)
                {
                    foreach (string s in Request.Cookies.AllKeys)
                    {
                        Request.Cookies[s].Secure = true;
                    }
                }

                Response.Cookies["ASP.NET_SessionID"].Secure = true;
                if (Response.Cookies.Count > 0)
                {
                    foreach (string s in Response.Cookies.AllKeys)
                    {
                        Response.Cookies[s].Secure = true;
                    }
                }
            }
        }

Then I have hosted my application on IIS 7.5 on my local machine. And enabled RequireSSL option in  SSL Settings. When I click Browse *.443(https), I could see localhost running with HTTPS but when I check cookie attributes in the browser, the secure flag is not set.

Am I missing any configuration here?

Your confusion is the result not of a coding or configuration error, but of a misunderstanding about how cookies work.

When the server wants to create or change a cookie, it does so with the Set-Cookie response header. There, the server can also specify how the browser should treat the cookie, e.g. how long to keep it, if it is secure or not, etc. This information is only sent once, when the cookie is first created.

At every request, the client sends all the cookies to the server in the Cookies request header. It then only sends the names and values. The additional information (e.g. the secure flag) is not sent. Those are instructions from the server to the client, and there is no need for the client to repeat the instructions back to the server.

So, a cookie is "secure" if the server included the secure flag in the Set-Cookie header. What the client then sends in the Cookies header is irrelevant. Trying to mark the request cookies as secure, as you do, therefore makes little sense.

So why are the sent cookies not reported as secure in your developer tools? It is simply because the field is not applicalbe to them, and therefore left blank. I don't know how to do it in IE, but if you switch to Chrome you can get a list of all cookies under the "Application" tab, and you can easily see which ones are marked as secure.

Disclaimar: I am not an ASP.NET programmer.


Why should you redirect the user to a login page after a password reset? The OWASP Forgot Password Cheat Sheet suggests:

  Whenever a successful password reset occurs, the session should be invalidated and the user redirected to the login page

I'm failing to understand why this is so important. Is there a security basis for this recommendation and if so, what is it?

Lets say an attacker has your password. You log in and reset it. If the reset doesn't invalidate all existing sessions, the attacker still has access, as long as they don't let their session expire.

The reset hasn't actually achieved anything in this scenario.

Depending on what the site does, there could also be issues with having you signed in under a password which is now out of date. Lets say your password is used to unlock something, you are signed in with "password1", but the server now has your password saved as "password2", what happens? This is obviously hypothetical, but hopefully illustrates the point.

Redirecting to the login screen I guess is just a recommendation. I'm not sure why it matters where you send the user, but from a usability point of view it makes more sense to send the user to a login page rather than the home page.


How to set reverse tcp connection when doing pentesting in VMs? msfconsole is a cool opensource pentesting tool from metasploit.

Once the exploit is valid, we can set payload to the victim. For persistent connection, we may need meterpreter.

But we often test security in Virtual Machines running msfconsole.

Without public IP, can the victim PC bind back to our local server in VMs?

Some suggestions?

As far as I know you can configure your VM so that the guest OS shares the physical network interface with the host. In that case if you start

nc -nlvp 8080

the listener is also listening towards the outside world. That should do the trick.


Storing RSA private/public key pairs in a file, on linux Would it be wise to:

Generate a lot of priv./pub. key pairs, and store them in a file on the server machine(Linux). (Let's say in a companies server room)
Then encrypt the file with AES, and store the AES key in server source code, directly.
Then, when the server needs one random key pair, it decrypts the file, and takes a random pair.

I know nothings always a 100% safe, but

EDIT: The Server is local, while clients are remote. (over TCP)

My question: Is this a more or less safe approach, and can someone steal/read the file somehow remotely, even tho I set the file permissions to my user only?

There's always a chicken and egg problem when you want to store private keys securely, but the app needs automated access to them. If you poke around this site you'll find plenty of related questions, for example:

Is it possible to automate use of passphrase-encrypted private keys?
automated decryption
How do automated systems store their keys securely?

Ask yourself what your threat model is; if you're only worried about remote attackers, then focus your efforts on hardening the perimeter of your server. If nobody can get in to your server, then encrypting it with AES might already be overkill.

If your threat model includes malicious users on that system, users introducing malware onto the server, or if whatever app the server is running is complex enough that it could become compromised, then protecting the keys at rest becomes a good idea. As you say, nothing is 100% secure; a software-based approach will always be breakable by someone with root access to the server and enough time to study memory dumps of your program. It sounds like what you're doing is reasonable. Some possible improvements:

Rather than have the AES key embedded in the source code, have an admin enter a password at process startup that is used to derive the AES key. That way an attacker really does need to be on your server taking memory dumps rather than being able to extract it from your binary or source code, which I assume is easier to acquire than a memory dump of a prod server.
You could maybe encrypt each private key with its own AES key just to increase the barrier between getting one key and getting all the keys.
The next big step up would be to generate the keys on dedicated crypto hardware so that the private keys are never on the server at all. Cheap option: a bunch of PKI Smart Cards dangling out of the server on USB dongles. Expensive option: a network HSM.


How does RSA encryption compare to PGP? On this answer ck says

  RSA and PGP are different.

  What you are essentially asking is how
  do I run my petrol car on diesel? The
  answer is you can't.

I would be interested in a more detailed comparison between the two, why they are different, and why one would choose one over the other.

RSA is an algorithm (actually, two algorithms: one for asymmetric encryption, and one for digital signatures -- with several variants). PGP is originally a piece of software, now a standard protocol, usually known as OpenPGP. OpenPGP defines formats for data elements which support secure messaging, with encryption and signatures, and various related operations such as key distribution. As a protocol, OpenPGP relies on a wide range of cryptographic algorithms, which it assembles together (which is not as easy as it seems, if you want the result to be secure). Among the algorithms that OpenPGP can use is RSA.

So, to keep with the car analogy, your question is like: "What is the difference between a combustion engine and a Honda Accord ? Why would one choose one over the other ?" The question makes no sense per se: the Accord comes with a combustion engine under its lid. It also comes with a bunch of other useful features, such as wheels; you cannot do much with a combustion engine alone.

Still in that analogy, you can imagine cars without a combustion engine, e.g. electric cars. Translated into the OpenPGP world, the question becomes: can OpenPGP perform its work without using RSA ? And the answer is yes: there are other asymmetric encryption and digital signature algorithms that OpenPGP can use, which will provide the same functionality than what OpenPGP uses RSA for. Historically, when OpenPGP was first defined, there were still a few unsolved questions about the RSA patent, so implementations were encouraged to use El Gamal and DSA (for asymmetric encryption and digital signatures, respectively), instead of RSA. (The RSA patent expired in 2000)


Using "Security Compliance Manager" to audit a Windows system I found a few posts which suggest using Microsoft SCM (Security Compliance Manager) to audit the security of Microsoft software solutions:

Windows security policy analysis tool
How do I apply a security baseline to Windows 2008 R2?
IIS and SQLServer Hardening

Here's a sample screenshot of SCM, showing "261 unique settings" for Windows 7 SP1 computer security:

What I don't get is how these "unique settings" are audited. I mean, SCM seems to simply report all hardening options, rather than checking (auditing) whether they are applied to Windows.

So far, I found the following way to (automatically) audit the settings:

Export them (using the panel to the right of SCM) as SCAP XML files.
Use a tool such as OVAL or jOVAL to audit the system against the exported XML files.

Along the same lines, I use the following approach to apply a baseline:

Export the baseline (or a customization thereof) as a GPO.
Apply the GPO.

My question is:

  Can SCM audit the settings itself, so that I don't have to export XML files and then use 3rd-party tools?

SCM itself does not audit or apply settings. Settings are applied by importing a GPO backup in to AD and reported on by importing a DCM in to SCCM (no relation to SCM despite the similar abbreviation).

There is documentation that describes how it all works under "attachments" for each baseline.


Detecting end-state of decryption process with unknown key Note: this question arises purely from a theoretical interest in security research.

Frequently in popular fiction we see white-hat hackers decrypt secret information in a matter of seconds. While this is obviously not likely in the real world, it got me thinking as to how one might actually go about such a process, given that we have the ciphertext but not the key.

The first object to decrypting the unknown data would be finding out what algorithm was used.
It is not too far a stretch of the imagination that we might be able to get this information, for example, it is possible to assume certain standard protocols are likely to have been used in particular situations (such as SSL/TLS on an e-commerce transaction). It is even conceivable to suggest that we might also know the length of the key.

The second main object is the amount of time that it takes to brute-force all possible combinations. This is frequently cited as a strong reason for the safety of cryptography (with a suitable key length). However, let us say we have the ciphertext, the algorithm and the key length (but not the key), as well as a highly-powerful computer capable of brute-forcing the entire set of possible keys in a reasonable amount of time.

The question is: seeing as we do not (obviously) know what the plaintext was, how do we know when we have cracked the encryption? It is one thing to enumerate all possible decryptions of the data, but how can we determine which of these candidates in the actual plaintext?

In theory you don't know.

But in practice you have some idea about what the data is or how it's structured. Perhaps because you know it's, say HTTP traffic, or because you know it's an encrypted .DOCX or .PDF file, or somesuch, or you are aware of some other properties of the plaintext (e.g. perhaps you might know that the plaintext is a binary blob followed by its 512-bit SHA-512 hash).

And even if you don't have any of the above, you can still try and make an educated guess on whether the resulting decrypted blob is correct by a statistical analysis.

Homework assignment: You may want to think of how this question applies to XORing a data stream with a one-time pad, and why that method is secure.


AES using derived keys / IVs. Does it introduce a weakness? I'm looking for an efficient way to encrypt multiple fields in a database with AES using a single global key, used throughout a large web application.

Obviously in order to re-use this key, a unique random IV is required for each field that is to be encrypted.

I'd rather not introduce more fields to the database to store each of these IVs, so the programatic approach seems to be to derive these IVs some how.

I'm toying with using either:

key = sha256(global_key + table_name)
iv = sha256(column_name + primary_key)

Or even simply:

key = global_key
iv = sha256(table_name + column_name + primary_key)

I'm leaning towards the former to generate per-table keys.

I've already read that the IVs do not need to be kept secret. So I'm working on the assumption that a derived key or IV (even if the algorithm becomes known), is no more insecure than any other non-secret IV, as long as the original key remains secret.

The question is:

Is there a fatal flaw in my approach? Am I introducing any serious weaknesses that, in the event that an adversary obtains a copy of the database, would make it easier for them to retrieve the plaintext data?

I realise that is potentially soliciting one word answers.

Suggestions for alternate / better schemes very much welcomed, as well as references to existing works and how they implement similar scenarios.

A potentially better approach would be to store the IV and ciphertext in one column. This way, you can generate IVs in the way most appropriate for your choice of encryption mode while also not having to add columns.

Something like "$AES-128-CBC$" + Base64.encode64(iv) + "$" + Base64.encode64(ciphertext) is similar to the format used in crypt, easily parseable, and being Base64-encoded is slightly more convenient when doing queries on the database using command-line clients.


Would using a password already hashed+salted be secure? Some basic principles of password security:

Hash it and use a salt
The people storing the password should never be able to see what the password is, just the hash
This hash should be difficult to crack

Assuming we're registering for a site that implements good password security. What if we were to take a easy to memorize password (it doesn't necessarily have to be a weak password) and performed the steps a website would do on the password and use the result as our actual password? The advantages (and please correct me if I'm wrong) of this are:

If the cracker isn't targeting this specific individual, but rather bruteforcing a login form, then the password should not be any easier to crack
You automatically get a strong password. The user only has to remember the "weak" password (think of pass phrases for SSH keys). If the user decides to use a "strong" password as the seed, and write it down, pretend they keep the paper in a locked safe guarded by armed security or something.
If the cracker determines this is the method that is used, it would take significantly longer because the hashing itself takes CPU time, and they would have to determine the hashing method used. On top of that, they would have to bruteforce the correct seed...

I know this is insecure and flawed somehow, but I would like an explanation.

performed the steps a website would do on the password and use the result as our actual password

This would almost solve the problem of password reuse.  If the user picked one master password and used a password hash to derive a different password for each service (by salting with the website's host name, for example), each site would theoretically be unable to access the user's accounts on other services.

However, I say "almost" because, in practice, most users choose passwords with insufficient entropy to be protected with password hashing.  This means that any service the user accesses (or anyone who breaks into any of those services) could crack the user's derived password to determine the master password, leaving the user completely compromised.  For this reason, randomly generated passwords + a password manager is still best practice, since the resulting passwords have no relation to one another (or to the master password).

That said, with a sufficiently strong password, this scheme is actually secure.  An 8-word password generated using Diceware would have about 103 bits of entropy.  If this scheme were used with a good password hash, it would be virtually impossible to crack the master password (assuming correct implementation, no crypto advances, etc).

As mentioned in the comments, it's still somewhat important that the server hash the "password" that it receives.  Imagine if an attacker is able to dump a user table, but unable to completely compromise the server/service.  Gaining access to the derived passwords would allow the attacker to any user's account on any part of that service, which could potentially widen the impact of the breach.

Just in case someone misinterprets this, let me include a quick reminder: implementing this in JavaScript alongside a login form would not provide any protection from a malicious server, since a malicious server can replace that JavaScript with something else.


Will changing the Wifi router fix a hijacked Wifi problem? The other day, I was browsing casually through the web with my laptop.  I visited a site that somehow managed to open a popup ad under my notice. This popup ad site I think has malware written all over it, like mining coins in the  background and how to make money fast.

I'm the kind of guy who doesn't want to take any risks, so I reset my laptop to factory settings and turn off my wifi because as far as I know, malware can infect your router and change your DNS while also infecting local computer.

Here is a three part question:

1) I have a spare router unused and unopened. Does changing the router fix this hacked wifi or is the gateway still compromised?

2) Is resetting to factory settings enough to eliminate malware or at least keep it at bay? Although rare, I see some cases in which the malware infects the boot partition.

3) My tv cable box is separated from my router but connected through wire. Can the router infect the box or the other way round?

If we are assuming that there actually is a malware risk, then all your assumptions are correct. It is possible that malware could exploit your browser, infect your machine, pivot to your router, DNS, and slowly take over every device in your network.

1) If the router is hacked, you do not have the same controls as you might have on a computer, so replacing it with another fresh router would solve that problem

2) "Factory settings" typically means that even the boot partition is reset, so depending on what a reset means, this should protect your device.

3) It is possible that malware could figure out your tv cable box, find an exploit and infect it, even if connected to the router by a cable (doesn't matter how it is connected)

But you know all this.

What I think you are really asking is if we think all this is necessary. The chances that malware that was designed to display ads would also be so advanced as to do all that is very low. Malware that is that advanced would not announce itself by displaying ads.

I would not go through all this activity unless I had some confirmation that there was infection.


Authenticating users on offline devices such as ipad We are wanting to authenticate the user inside a webapp (JavaScript/HTML inside browser) running on a tablet, but want to be able to do this when the device is offline from the network. I realize this isn't super secure environment already, but I don't want to make it less secure by a poor authentication method.

The environment is a web app that runs on iPads inside a corporate network. Users take and share iPads (that's OK) but we need to authenticate that the current user of the webapp is valid, blocking random people/staff that might pick up the device. Network connectivity is not 100% and this cannot be readily improved. Our aim is more validation for audit purposes than security control, we need show that user X performed the action on the iPad.

Authenticating when we are on the network is easy, send a packet to server and get a yes/no response. However if we are offline we cannot do that. I could download all users and password hashes to the iPad, but this seems like a bad idea - I've just exported the password file, this just feels wrong.

The next idea was separate online and offline passwords, but that seems too hard for users.
We also considered trusting the login and deferring validation until we are back online, but that has business/application issues.
Currently, we're going with normal passwords for main app as normal, but using a visual password on iPads, basically two passwords but presented different so users don't perceive it to be the same. Having two passwords means we can have different policies, controls and audits.

Are there any better ways of doing this?

I'm sure you didn't intend it to be so; but this is currently a politically-charged question, as well as a technical one.  Some appsec experts believe that crypto implemented in javascript is inherently flawed; and they make some good arguments, only a few of which are inapplicable due to the javascript being accessed only on an intranet, and only on one kind of device.

Authenticating a user on a device with no network connectivity means storing a password hash on the device. There's a lot of clever things you can do with crypto, but you can't get around that. The best you can do is to use a strong password-based key derivation function, understand that this may still leave you quite vulnerable, and use compensating controls:  Physical security and policies to make it difficult/risky to extract the hashes from HTML5 local storage and take them home for offline cracking.

This leaves the question of which password hashes you store locally. It sounds a little like you're only interested in non-repudiable actions:

  we need show that user X performed the action on the ipad.

If the only reason you're using authentication is for non-repudiation, and a single repudiable action constitutes a complete break of the system, there's not much point to having two separate passwords for each user.  If you have additional security goals beyond that, it may be worthwhile to keep two separate passwords; especially if user compliance isn't an issue--and your UI solution for that does sound effective.


Are there any security risks associated with having static files on the server be publicly available? I am going to frame this question using ASP.NET Core in mind since that is what I'm using, though my question is applicable to any scenario in which you have a client that makes requests to a server storing static files.

In the Microsoft docs on how to order middleware in an ASP.NET Core application, it specifies:

  The static file middleware is called early in the pipeline so it can handle requests and short-circuit without going through the remaining components. The static file middleware provides no authorization checks. Any files served by it, including those under wwwroot, are publicly available. See Work with static files for an approach to secure static files.

I can see that it would be useful to bypass authentication

in order to serve these files faster.
because these static files (consisting mainly of HTML, CSS,
JavaScript, and various types of image files) are in no way
obfuscated on the client (for authenticated users, mind you).

However, there's a part of me that feels iffy about allowing all these files to be publicly available considering you have to be authenticated to be able to access the site. Since these static files contain a lot of the site's scripts and other resources, an unauthenticated user who would normally be able to not interact at all with the application can suddenly see a lot of how the front end works.

Is there any information contained in static files that would be useful for an attacker, such as a partially-complete picture of the front end codebase? My guess is no, because if that were the case then that implies that we trust all authenticated users to not use that information maliciously. Nevertheless, I wanted to make sure by asking here.

There could be risk if any of the static content is customer data or PII for example things like personal photos , scanned in drivers licenses , medical images like xrays, completed user forms scanned in, etc.

If that data is only accessible behind a login screen normally but then you dump it into a publicly accessible CDN or AWS bucket for example now you have an issue of data leakage.

I would not be worried about HTML , CSS, or JavaScript as none of that should contain the keys to your kingdom anyways. That's all stuff you expect to be accessible client side and so you treat as public already.


How should I construct a secure redirect_uri? I have read a number of questions on the underlying necessity of a redirect_uri. I don't want to screw this up! Can anyone give an example of how a secure redirect_uri could be constructed? For example,

mysite.co/securepage.php.....

Other than a page somewhere that is obscure, is there something that must be in the page to validate a client request..

Many thanks.

UPDATE: This is all intended to incorporate a service (Uber) into my app. This is their authentication page:

UPDATE: after clarifications added to the question following comments, the "redirect" part is actually part of oAuth in the provider's API and not related to the OWASP section I initially pointed to. I leave it nevertheless for the record.

There are certainly security elements to take into account writing this redirect page (as with other exposed pages) though.

When you allow a page redirect you basically put your reputation at stake. Someone seeing http://myserver.mycompany.com/whatevercomeshere expects whatevercomeshere to be trusted.

How to do that is introduced in the OWASP Unvalidated Redirects and Forwards Cheat Sheet.

  Simply avoid using redirects and forwards.

  If used, do not allow the url as user input for the destination. This
  can usually be done. In this case, you should have a method to
  validate URL.

  If user input can’t be avoided, ensure that the supplied value is
  valid, appropriate for the application, and is authorized for the
  user.

  It is recommended that any such destination input be mapped to a
  value, rather than the actual URL or portion of the URL, and that
  server side code translate this value to the target URL.

  Sanitize input by creating a list of trusted URL's (lists of hosts or
  a regex). Force all redirects to first go through a page notifying
  users that they are going off of your site, and have them click a link
  to confirm.


Why do some large companies still store passwords in plain text/decrypt-able format? In the last couple of weeks I've come across two fairly large companies who seem to not have stringent password security:

Tesco - they store passwords in an "encrypted" format, yet they can decrypt the password and then email it to you when you click "I've forgotten my password"
Plusnet - they store passwords again in some form of plain text/encrypted format but decrypt it and show it to you when you click "i've forgotten my password". Not as bad as Tesco, they don't send you the password by email, however they send a "recover password" link and on clicking that a browser window opens which shows your password in plain text (admittedly over a https connection).

My question is, what is the reason behind this? Both Tesco and Plusnet are storing customer's credit card details so surely security should be at the forefront of their mindset.

I want to know if I am wrong for believing that they are storing passwords insecurely. Will they have processes, policies and technologies in place which make this situation secure enough that the way they store their passwords is trivial?

Will they have special two way encryption that cannot be cracked by hackers? e.g. the same way that https, or API's work with a private key?

Will they have adequate security on their databases such that this will never be an issue, hackers will never get access to the data? (Judging by linkedin, sony and yahoo this is always going to be an issue!).

Or am I right in believing that it is wrong, and if so why? Are company's ignorant? i.e. they don't understand/know that what they're doing is wrong? Are they arrogant? i.e. they think that no-one will ever hack them? Or is it something else?

Thank you.

There's a lot of issues here.

First, a lot of companies just don't really see this as a vulnerability. They think encryption is enough and they think that they're not really a target anyway. They won't realize that they're wrong until after someone breaks into their database and steals all of the passwords they stored.

Next, there's some knowledge issues. How do you securely store passwords? Salting and hashing with MD5/SHA like you mentioned is actually not secure. You should use adaptive hashing algorithms like bcrypt. Many developers just don't know the correct way to do things like this, especially since the most-secure method changes fairly often.

There's also the issue of usability. If you hash the password, you cannot offer your users the ability to retrieve their password. Most users don't realize that this is a vulnerability and want this as a feature. The companies probably value usability over security. This goes back to the companies thinking that they're not a target, so they don't need to bother with adding all these security features. Also designing a proper password reset is non-trivial to get right.


Fingerprinting servers behind firewall I am currently testing some servers that are present behind a firewall. During the scanning I am unable identify which ports are open except port 80.

I have used various switches for Nmap only -Pn works and it outputs that port 80 is open and service is httpd.

Is there any alternative method or tool which I can use to bypass the firewall and identify which ports are open on the servers?

There are a lot of possibilities for that:

1- No ports are really open other than 80.

2- Firewall is not blocking your IP but it might be evade your results and this only with advanced firewall.

3- NMAP by default scans only 1000 TCP ports and there are other open ports so make sure to scan full TCP & UDP port range.... namp -sU -Pn -p 1-65535 will scan full UDP range.


Emergency method to erase all data off a machine within seconds Imagine you are carrying highly sensitive information with you, maybe on a mission in a war zone. You get in an ambush and quickly need to erase all the files before they fall in the wrong hands. This has to happen within seconds.
What devices are used for such operations, are there special hard drives which have a physical switch to erase all memory at once? I'm thinking of active storage devices, which lose all information once the power supply is separated.

Addendum 1: As Artem S. Tashkinov pointed out in his answer, for most use cases encryption is enough. But I think there is information so valuable, that even in 50 years, when quantum code breaking may become a reality, it can be harmful. So I edited my question to ask explicitly for a method, which does not leave any way, as computationally hard it may be, to recover any data. I guess this is only possible by physically destroying the components, which hold the information.

Addendum 2:

Issues with thermite: Data drives seem to be quite resilient to thermite and even military grade thermate as shown at a talk at defcon 23. It doesn't seem like using either of these substances is a reliable way of getting rid of the data. The experimental results showed that the drive was mostly intact after the thermite/thermate attack and it seems unlikely that Curie temperature has been reached throughout the plate. (DEF CON 23 - Zoz - And That's How I Lost My Other Eye...Explorations in Data Destruction (Fixed), thanks to Slava Knyazev for providing this ressource).
Issues with encryption: While quantum code breaking will not break all existing encryption (as pointed out by Conor Mancone) there is still a risk that flaws in the encryption are known or will be discovered in the future.

Thermite.
Thermite burns at a temperature of thousands of degrees centigrade, which would be more than sufficient to destroy all the data stored in any modern data storage medium. It is also already used by militaries for the targeted destruction of equipment. Additionally, according to Wikipedia:

For example, thermite can be used for the emergency destruction of cryptographic equipment when there is a danger that it might be captured by enemy troops.


Cleaning a virus by mounting the infected hard disk on another machine? I have a laptop that has been infected with a virus.

I am thinking of taking the disk out of the laptop, putting it into an external disk enclosure, and connecting it to a second laptop so I can run avast on it.

Is it a good idea? Can the virus be completely removed?

Here's what I recommend:

If there is no valuable data on the disk, just wipe it and reinstall from scratch.
Otherwise, boot from a LiveCD (ideally one with a different OS), salvage your data, then wipe and reinstall.
If you cannot afford to wipe (although I can hardly imagine why that would be the case), boot from a LiveCD and try to get rid of the malware from there. The problem with this approach is that you can't be certain that it actually worked - you may have removed obvious infections, but the better ones may remain undetected.


For maximum security is it best to link OpenSSL libraries statically or dynamically? When linking to OpenSSL (or other cryptographic libraries) would it be more secure to use a shared library and have address space layout randomization, or to use a static library and not have ASLR?

ASLR and such things are ways to try to cope with consequences of a buffer overflow -- they are an hide&seek game so that attackers find it harder to turn a buffer overflow into remote code execution. For proper security, it is better to make it so that buffer overflows don't occur in the first place.

... and for that, dynamic linking is better. The reason is the following: it would be inordinately optimistic to believe that any given piece of code written in C does not have any buffer overflow (especially OpenSSL, which has a rather long history on that subject). Thus, the best that you can do is to be able to promptly fix known security holes by replacing the faulty part. If you use dynamic linking, this is easy: just replace the DLL, and be done with it. If the DLL is provided by the OS (the normal case in Linux systems) then this will be done naturally when you apply security updates from the OS vendor. However, if you use static linking, then the patches won't make it into your application until you recompile (or at least relink) that specific application with the patched OpenSSL.

In practice, static linking means that security fixes on the library will take longer to be applied to the application -- or, more often than not, won't be applied at all. This is bad. Therefore, use dynamic linking.


Sanitizing a USB HDD in Linux I want to check that an external USB hard disk drive is free of viruses and malware before connecting it to my primary use computer.

I have it in mind to perform the following steps to ensure that the drive is effectively clean:

remove the HDD from an old laptop
boot from a Linux CD, known to be clean
connect the USB HDD
open terminal
navigate to the USB HDD directory
enter the ls -a command
delete any files or directories that I cannot account for

After taking these steps, should I be able to assume that my USB HDD is completely safe to use?

(Notes: Unfortunately, I am not familiar with running virtual machines, and obviously, I don't trust third-party software scans to do a good enough job of detecting everything for me.)

UPDATE:

Here is some more background information:

Yesterday, I bought a brand new 1TB USB HDD, which was NTFS formatted out of the box. I purchased it to backup files from my MacBook, which according to Avira and MBAM, was free of unwanted infections.

After connecting the USB HDD, the first thing that I did was to reformat it to utilize the Mac OS Extended (Journaled) file system, and afterwards, I copied my files to the drive.

Then, I erased the hard drive on the MacBook and installed a fresh copy of OS X via Internet Recovery.

If Avira and MBAM failed to catch anything, how can I make certain that I won't be reintroducing anything unwanted when I connect the USB HDD to my newly reformatted machine?

I used the following steps when I was planning to re-cycle an old laptop HDD into an external storage. Perhaps this may give you some ideas. Note: This procedure will delete all your data and you will not be able to recover it.

Got an HDD Enclosure kit with USB. This converted the old HDD into an external drive.
Connected to my Laptop running Linux but did not mount it.
Went to System > Hard Drive.
Found my external HDD.
Re-format the HDD (Write 0's to the entire disk). This will delete all files from the disk, format it and write ZEROS (0) to each sector.

This will basically delete all data from the drive and wipe everything including any malware or malicious files.

good luck !


Is there a list of open mail relays I can use for a pentest? I'm currently pentesing a client (with permission of course) and we are testing their email filtering capabilities. We want to check whether they reject mail coming from open mail relays, but I seem unable to find any. Is there a list somewhere that we can use? The less reputable the better.

There are Domain Name System-based Blackhole List (DNSBL) like SORBS, but they all work the other way around, allowing to test reputation for known IP address. There's a good reason for that.

While you may have permission to test your client's systems, but you don't have permission to use 3rd party servers for your penetration testing! The open relay servers are typically in this condition by accident.

You are confusing two different things: technological term open relay and Mailgun’s service, which isn't really open as it needs registration. The latter is not illegal, but for the same reason it's not any good for your penetration testing, as it's not necessarily blocked by a DNSBL even if your client has one or more configured.

Instead, you should be testing if your client's servers works as an open relay or a partly open relay due to misconfiguration. Recommendations regarding inbound spam filtering can be given without testing, based on the mail server configuration.


Securing passphrase on DB I have stored encryption keys on the database that are encrypted with a passphrase. To decrypt it the owner/user must login using his passphrase, and that will be used to decrypt the encrypted keys on the DB. My concern is, to verify whether the entered passphrase of the user is the right one, I would have to store a hashed version of his passphrase. Will there be any security issue or is it enough to stop atleast most of the basic attacks. FYI, the system will only have like 2-3 users therefore I am really worried that they could brute-force the stored hashed passphrase.

We can make use of MAC(Message Authentication Code) rather than just storing the hash of the passphrase in the DB.
MAC Generation
Once the key is encrypted, MAC is generated. We follow Encrypt-then-MAC mechanism.
You can generate a tag = MAC(m, k) where

m is the encrypted key
k is the key you use for encrypting the users' key (passphrase)

This tag is then stored in the DB instead of the hash of the passphrase.
Checking Passphrase
To check if the passphrase is correct or not, we can easily verify it by generating the MAC again in a similar way, with the key as the passphrase from the user. Now, the generated tag and the tag stored in the DB are checked, if they are equal.
If equal, it is a valid passphrase and the decryption of the encrypted key can proceed. Otherwise, we can throw a message to the user that the passphrase is incorrect.
MAC Algorithms
You can use HMAC (Hash based MAC) from OpenSSL for handling the tasks of MAC tag generation. Appropriate bindings would be available for whatever language you are using in your app.
edit: Make sure that a strong hashing algorithm like SHA256 or SHA512 is chosen for HMAC generation (and not MD5 or SHA1 as shown in the examples in the above link)


How likely is it that I was hacked by running a local server for development? Over the last couple of days I've been learning Apache and servers in general - I installed Apache, PHP and mySQL on my Ubuntu system and accessed my website with 'localhost'. I have always thought that when you run something as localhost, nothing ever leaves your computer and your server can't be accessed by computers in your WiFi network, let alone other computers connected to the Internet. However, I got scared when in a tutorial video I watched they told to turn off your Internet connection as soon as you install Apache. Is it justified? There are no sensitive information in the database or in /var/www, it's all dummy data just for learning purposes, but I'm worried that somebody could hack into my whole system.

Keeping in mind that I've been doing this for the last few days, should I consider myself hacked?

And to make it clear, when I run my server locally and can access it through localhost, is it available to people on the Internet?

have always thought that when you run something as localhost, nothing
  ever leaves your computer and your server can't be accessed by
  computers in your WiFi network

You accessing your services through localhost doesn't mean that it's running as localhost:

When starting a daemon, such as Apache and MySQL, it can run on localhost or on all interfaces.  If your IP address is, say, 10.0.0.5; and Apache runs on all interfaces; you can access your pages on both http(s)://10.0.0.5 as well as 127.*.  Now, even by running it on all interfaces, if you're protected by a NAT device, such as your default access points, it's unlikely that someone routes into your network.  Of course, all users on the same network (WLAN, ...) could access your daemon.

The best way to check this is to run a netstat -an on your machine, the output should be something like:

$ netstat -an
Active Internet connections (servers and established)
Proto Recv-Q Send-Q Local Address           Foreign Address         State       PID/Program name
tcp        0      0 0.0.0.0:22              0.0.0.0:*               LISTEN      -
tcp        0      0 127.0.0.1:6379          0.0.0.0:*               LISTEN      -
tcp        0      0 0.0.0.0:25              0.0.0.0:*               LISTEN      -
tcp6       0      0 :::80                   :::*                    LISTEN      -

Here can see that SSH (22) runs on all my IPv4 interfaces, 6379 (redis) runs only accessible on localhost and http (80) runs on all IPv4 and IPv6 (:::80) interfaces.

Running them locally only depends on the deamon itself, apache allows a Listen 127.0.0.1:80 in the httpd.conf file, MySQL allows you to put a bind-address = 127.0.0.1 in the my.cnf file (under the [mysqld] directive) and so on.  An additional measure you can do is to block all ports using IPTables on your interface (wlan0, eth0, ...), and only allow the services you intend to publish.

It's unsure to consider "yourself hacked".  It was, if exposed, for sure subject to it.  It depends if you have poor credentials, vulnerable versions, ...


Can admin see my password when I enter it? If the admin is a super user, nothing can prevent them from installing anything on my host, including keystroke logger. Are there any security mechanisms that can protect my account against that?

No, you can't protect yourself against a privileged user. Any piece of software you can install to protect you could be uninstalled or deactivated by the privileged user

That's why is told that when a computer is compromised and the attacker gets root access (Or is possible that he did) you just don't control that computer anymore

If you don't trust the computer administrator or whoever has access to an administrator account then you shouldn't store any data that you don't want them to access


Password protecting folder in windows using a .bat/ .exe file: is it such a bad practice? I have been browsing the internet looking for simple ways to password protect a folder in Windows 7 without any extra software nor BitLocker.

I have found several places that state that using a .bat file (and then converting it to an .exe file to avoid people opening it in a text editor and making sense of it) would allow this.

However something tells me this is a not very secure system.

I share here some of the typical .bat file's code they claim to work and password protect the folder:

@ECHO OFF
if EXIST "Control Panel.{21EC2020-3AEA-1069-A2DD-08002B30309D}" goto UNLOCK
if NOT EXIST Private goto MDPrivate
:CONFIRM
echo Are you sure to lock this folder? (Y/N)
set/p "cho=>"
if %cho%==Y goto LOCK
if %cho%==y goto LOCK
if %cho%==n goto END
if %cho%==N goto END
echo Invalid choice.
goto CONFIRM
:LOCK
ren Private "Control Panel.{21EC2020-3AEA-1069-A2DD-08002B30309D}"
attrib +h +s "Control Panel.{21EC2020-3AEA-1069-A2DD-08002B30309D}"
echo Folder locked
goto End
:UNLOCK
echo Enter password to Unlock Your Secure Folder
set/p "pass=>"
if NOT %pass%== wonderhowtogoto FAIL
attrib -h -s "Control Panel.{21EC2020-3AEA-1069-A2DD-08002B30309D}"
ren "Control Panel.{21EC2020-3AEA-1069-A2DD-08002B30309D}" Private
echo Folder Unlocked successfully
goto End
:FAIL
echo Invalid password
goto end
:MDPrivate
md Private
echo Private created successfully
goto End
:End

Would this be easy to crack after we export it into an .exe file? What if I encrypt the .exe file for extra security?

And also, would the folder need to be hidden for this "trick" to work?
What are those keys like 21EC2020-3AEA-1069-A2DD-08002B30309D?

Thanks very much for throwing some light over here.

This batch script doesn't protect anything at all. It just renames the folder in question and sets the system and hidden attributes, which makes the folder a little bit harder to find and might keep your ten-year-old child from seeing it, but it won't stop anyone else.

At most, we might call this "security by obscurity", but I'm hesitant to even call it that, because in reality, setting the hidden and system attributes don't obscure that much.

There is no encryption going on at all – the folder doesn't get password-protected, the password is only used in the batch file to block someone from using the batch file to automatically remove the hidden and system attributes and rename the folder back to something sane.

  Would this be easy to crack after we export it into an .exe file?

Yes. Simply extract all strings from the .exe file and you'll find the "password".

  What if I encrypt the .exe file for extra security?

Again, the script does not provide any security at all. If you encrypt the batch/.exe file, you make it harder to use, but you don't actually make the folder in question more secure.

  What are those keys like 21EC2020-3AEA-1069-A2DD-08002B30309D?

These don't mean anything by themselves (edit: see Bob and Danny's comments about junction points for an explanation of their meaning). They might be part of a larger system the batch file is part of, but they don't add anything to the security of the actual folder – it's just part of the folder's new name while it is "hidden".

What to do instead

You've already said it: Use BitLocker or VeraCrypt. Veracrypt can work with container files which will contain a whole tree of folders and it offers real security, as does BitLocker.

If you don't want to use any extra software, do what Mike suggests and zip the folder, protecting it with a password. This offers you nowhere near the security of BitLocker, VeraCrypt, and compatriots, though.


What information can mouse recorders get? In comparison to keyloggers, mouse recorders do not seem to be able to obtain much sensitive information. For example, passwords, credit card numbers, email addresses, names, passport numbers, etc. can be obtained using keyloggers. But what about mouse loggers? What can mouse positions and mouse clicks reveal to a spy?

If one  knows what is on the screen the movements and clicks tell a lot.

In order to protect against keyloggers some banking applications started to use on-screen keyboards to enter sensitive data like PIN or TAN. But then malware  started to track mouse movements and clicks to get back the information of what the user was doing. Banks tried to fight this with randomized layouts of the keyboards which only lead to not only tracking the mouse movements and clicks but also to do regular screenshots so that the clicks and movements could be interpreted.
See also the article Virtual Keyboard and the Fight Against Keyloggers.


Security risks of OAuth vs a password manager Of the following two approaches, which is "more secure", under which circumstances, and why? In other words, please compare the security risks of these two approaches:

Log in to an OAuth provider such as Google or Facebook using a master passphrase; then use OAuth/OpenID to log in to other services via that OAuth provider.
Use a password manager with the same passphrase; have it generate and auto-type a separate random password for each service.

This question explains how OAuth and OpenID work and why they're considered secure, but it doesn't compare it to a password manager.
Motivation:
From my perspective as a user, OAuth and password manager solve the same problem of not having to enter separate passwords (or any passwords at all) when logging in to various services. OAuth does it by "reusing" my login into the OAuth provider (I understand the technical details are more involved, but that's how it looks to me as a user). A password manager does it by automatically typing in the password for me.
Either way, I only need to enter a single master passphrase: either to the OAuth provider or to the password manager.
I'm trying to decide when to use which solution. To do that, I want to understand their security implications more in depth (and compare them where possible).
OAuth vs separate accounts (with separate passwords), as noted by @schroeder , is one aspect of this. But a password manager is necessary to automate the password entry, and adds its own layer of security risks. So it's also an important piece of the puzzle, I think.

Neat question, I had not thought before to compare those as competing solutions, but I suppose they are!
I'll answer this from the perspective of the Confidentiality - Integrity - Availability security triad.
Integrity for the OAuth case is a one-shot deal; you lose your main password and you're toast everywhere; your accounts now belong to the attacker, good luck getting them back. That may also be the case if you're using a cloud-based password manager, but offline file-based password managers give you more control over where your password data is stored (ex.: if the only copies are on your phone, your laptop, and a USB hard drive, then that's harder for an attacker to get their hands on).
Availability boils down to what happens if you forget your main password, delete your password manager db file, lose your phone and don't have a backup, or otherwise lose access to your account. Here the OAuth providers probably win because it's generally easier to recover your account with one of those services than with a password manager.
Last but not least, to me the big difference is Confidentiality -- You will notice that, in general, the companies providing free large-scale OAuth services tend to be advertising / user analytics companies. They directly benefit from being able to track you across 3rd party sites. So if you're even a little bit interested in anonymity, then making separate isolated accounts on different sites, you're making it one step harder for people (either other end-users, or the networks themselves) to correlate all your accounts.


Does KASLR really provide more security against exploits? I know all about how ASLR works, and how it has been implemented on both Linux and Windows systems.  It provides an extra layer of protection that malware has to take into account.  But nowadays with computers being left on for long periods of time ASLR doesn't seem to randomize the address space as much as we would like.  Windows 8 has taken extra steps to ensure that ASLR is effective.
I just found out about kernel level ASLR when I built and upgraded my Linux kernel, and noticed that on boot it said:
KASLR not enabled
After doing some searching I didn't find that much on KASLR in general.  So now I'm curious if anyone here has experience with it.

Is KASLR worth it?  Does it provide a significant advantage?  I would have to rebuilt my kernel, configure it for KASLR and all that jazz.  Not terrible, but slightly annoying.
Does this exist in the Windows world?  If so, does Windows do a better job at its implementation?

Or maybe the world just isn't ready for it yet...

KASLR has gotten under heavy critic on the day it was released for Linux, and it has also been defeated on that very day. Spender at grsecurity has written a post about it (along with LWN comments) which I'll only summarize in a simplistic way. I highly encourage reading the original source.
Address Space Layout Randomisation was originally applied to complicate exploits, as we all know, by randomising the position of a lot of pointers on the stack. Defeating ASLR requires either of:

bruteforcing until you accidentally find the correct random address (which requires re-launching the app and barely ever applies to KASLR)
retrieving pointers that leak information about the memory layout

The second option is very promising for kernels: they can't have too much of a large random offset because some hardware configurations might have a limited address space, and most importantly kernels can't change their offset throughout their entire life cycle! This means a single memory layout leak will defeat KASLR until the machine is rebooted. It turns out that this kind of bug is said to happen pretty often by Spender.
This is exactly why Linux KASLR is weak, and even "a failure" according to Spender. The mechanism was not intended for kernels. Do read his article if you want more details. He does speak about other implementations and you should understand from the points made above that it is not the implementations only that are weak, but rather the design. KASLR needs a lot more care in how it is implemented than traditional ASLR because the conditions for exploitation are much more favourable.
Edit: and apparently you're just a Google search away from knowing how to exploit the Windows KASLR implementation.


Is it safe to set "Access Control Allow Origin" header's value to the "Origin" header's value which is implicitly set by the browser? I was testing a website and noticed that changing the "Origin" Header's value of a request with an intercepting proxy application results in the web application sending a response with "Access Control Allow Origin" set to the same changed value. I read that the Origin header is protected by the browser and cannot be changed.
I want to know if there can be any potential risk associated with this scenario.

If the server simply mirrors the Origin provided by the client into the Access-Control-Allow-Origin header of the response without further checks then it essentially allows any third party to access the resource cross-origin, i.e. it would be a security issue if cross-origin access should be restricted.

But, if this mirroring is only done after additional checks, for example only if the client is authorized, then this is less of a problem. Although there might also be cases where it can be a problem also in this case.

In summary: if this is a problem or not depends on information which are not provided in the question.


A new virus with unknown function We have detected a new virus that was sent to us by mail.
The email contained a zip file which contains an executable with the same name.
As a first step, we uploaded the file to virustotal, to be able to know if it was defined by any antivirus company. So far only 4 companies detected it:

(Antivirus : Name ):ESET-NOD32 : Win32/Crypt.NAC /Ikarus : Trojan-Spy.Agent /Sophos : Troj/Bredo-AKN /
TrendMicro-HouseCall : TROJ_GEN.F47V1114

Does anyone know what does this kind of viruses do ?

Addition:
We ran the Sophos scanner on potential infected PCs (Who unzipped the file). The scanning results implied that the PCs were clean, knowing that Sophos discovered the trojan in the first place.

From some malware analysis lab. every day more then 68 % of malware goes undetected by any anti-virus.

How did you detect this one?

You may ask Fireeye an analysis of this malware.


How to validate client side safety in a Zero Knowlegde model What is sometimes called Zero Knowledge, sometimes end to end encryption occurs when a server only processes ciphered data (at least for sensitive data) with a result where a compromise of this server does not threat the confidentiality of the data.
In this model :

the data are deciphered at the client side (web browser, smartphone app, ...)
the data are always encrypted before to be sent to the server
the cipher key is never transmitted to the server

Some examples of existing architectures like this are privatebin, cryptpad, signal app, protonmail (not sure)
This kind of architecture is interesting because even if a hostile third party (government, hacker, ...) tries to take over the main server, the users'data remain unviolated as the key is never known by the server.
The counterpart is that when a user lost the key, the data are lost for ever (or until the next AES breakdown).
However, if the main server is compromised, the opponent can still change the code served to the client side and introduce malicious html/javascript to receive the clear data.
So this model is not perfect yet.
My question is : is there a way to ensure the client side code authenticity to avoid executing malicious code sent by a compromised server ?
The last time I talk with a dev at cryptpad, he told me about code signing for website. They tried to dig the idea of publish open source client side code, sign it somewhere and make the browser checks that the signature is the same as the one associated with the auditable open source code.
Is someone knowing something about that ?
This question came to my mind because, today, many people talk about Zero Trust for the Cloud based architectures.
I'm not sure to have the same definition of Zero Trust but I'm quite chocked to never see anywhere a little concern about the fact that, currently, no Cloud based architecture can be resilient to AWS compromise (or AWS becoming hostile). Something I feel more like "zero trust except amazon"...
Zero knowledge could be a solution but not a complete one until the client side is still exposed.

My question is : is there a way to ensure the client side code authenticity to avoid executing malicious code sent by a compromised server ?

Short Answer
No, there is currently no perfect, practical way to ensure that the server doesn't go rogue and serve you malicious code without raising any obvious red flags.
Long Answer
A complete Zero Trust model is simply not practical for web/cloud applications, and as far as I know, there are no 100% zero trust web applications, only zero knowledge ones where you still have to trust them to serve you secure code. If you can't trust a server to handle your secrets, you cannot trust it to serve you secure code either. Currently, the best possible way is what you have already mentioned in your question. The developers will have to publish the code so others can audit it and ensure that there are no backdoors.  Then it lies on the end user to compare checksums and confirm that the code they received from the server is the same as the code published.
Of course, this approach is nowhere near perfect because of its sheer inconvenience. No sane human can be expected to manually check the integrity of every web page they visit. A better approach would be to have signed copies of the source code hosted on independent servers from where the browser (or perhaps an extension) would be able to ascertain whether the code it receives from the web server is the same as the publicly auditable version and hasn't been modified to include backdoors (and now you have to trust the independent server... although chances of both of them being compromised or going rogue simultaneously would be lower). But no browser currently supports this capability (and there isn't any established protocol for it either).
In the end, you'll just have to trust the developers and maintainers of whatever web/cloud service you're using and hope that if they get compromised (or are served a subpoena and gag order), someone will notice before any damage is done. The alternative is not trusting the cloud and relying on open source software running on trusted hardware.

The only source I could find that even remotely tried to address the problem of serving trusted code in a zero trust model: https://clipperz.is/blog/2007/08/24/anatomy_zero_knowledge_web_application/


What measures can be taken to prevent Server Side Request Forgery (SSRF) in a JAX-RS Application running on Apache Tomcat? If I have a an application server that uses an implementation of JAX-RS, and is running as *.war file on an Apache Tomcat server, is there anything special that needs to be done or configured to prevent SSRF attacks?

My naive understanding is that JAX-RS application are only serving requests to certain URLs and Apache Tomcat only allows requests to certain resources.

If this is handled by default by JAX-RS or Apache Tomcat, could you explain how?

If this is not handled by default by JAX-RS nor Apache Tomcat, could you explain the best way to prevent this type of attack with these tools?

Specific versions:

JAX-RS api 2.1
Apache Tomcat 9.0.33

Neither Tomcat nor JAX-RS documentation mentions anything to prevent SSRF attacks. So I would assume there is no protection by default.

SSRF typically abuses the trust placed in a server by other entities. Which is why in your case it is important to vet the vectors used for connections initiated from the server. So validate your input. For example, if your server depends on a user supplied URL to fetch something, then validate that URL and allow only the target hosts that you trust and block localhost.

OWASP has a cheatsheet for SSRF and gives a pretty good overview of protection methods.


Linux equivalent to Windows WriteProtect key in the registry for a software based write blocker? I unfortunately don't have access to a physical write blocker and am looking for a software based write blocker in Linux.

In Windows this can be achieved by modifying the registry and setting a DWORD named WriteProtect to 1 in HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\StorageDevicePolicies.

Linux doesn't use registries but relies on files. Is there a file I can modify which will block writing to any removable drive?

You can ro (read-only) mount removable drives.

As to how you can set automount options is answered on another question.