Online shops SSL certificates and VISA/MasterCard Is it still allowed to use SHA-1 certificates on VISA/MasterCard payment pages?

If yes, will it be prohibited and when?

I know about browsers are going to show it as non-secure after some time, but want to know about VISA/MasterCard guidelines.

No, it is not (and hasn't been for years).  Use of a SHA-1 certificate will trigger a failure in any current compliance audit.

U.S. NIST and PCI regulations currently require the use SHA-2.

Or for more detail:

  PCI compliance scanners currently require their clients to use SHA-2-compatible SSL certificates. In order to validate PCI DSS compliance, you must ensure that Web server(s) in the PCI environment are configured to disallow SSL (Secure Sockets Layer) Version 2, as well as weak ciphers and hashes. PCI network scanners finding SHA-1 certificates will fail a compliance audit.


Break into WPA2-Enterprise RADIUS wifi network by stealing credentials I need to ensure that no un-authorized DEVICE gains access to a wireless LAN network.

Notice I said, "device".  This means that I need to ensure that only authorized personnel can join the LAN and also that they can't use a non-authorized device.

A RADIUS WPA2-Enterpise network is set up.

My concern is that authorized individuals that have been given a device such as a phone may extract the login credentials (username and password) and or the certificate stored in their device (android phone, iphone, windows laptop, mac laptop, linux laptop).

Then with the extracted username/password and or certificate, they can join an unauthorized device to the LAN.

Is the attack as I've described possible?  If so, how can I protect against it?

It is possible, and you cannot prevent it.

Most devices will allow administrators to backup or extract certificates, including the private key. Your perception of security is not in line with the actual, real world practice.

Someone (or some group) must authorize the devices. Typically, the technical authorization mechanism is handled as a completely separate process from the management review and approval. These processes are usually performed by two entirely different sets of people. The key element here is trust.

So how do you have any security at all?

Your only choice is to trust your administrators. In the interest of robust security, however, you always verify when you are forced to trust.

How do you verify? You can review logs from your 802.1X or RADIUS network devices for problems. Does the "same" device have an active connection in multiple places at the same time? Does the "same" device show up with many different MAC addresses when it only has one NIC?

If you have an asset tracker or a vulnerability scanner, you may detect rogue devices this way as well.

The bottom line: You should perform regular monitoring and enforcement of the security policy, or eventually things will go as badly as you fear.

What about things you can't trust?

Some devices are inherently untrustworthy. E.g., your admins might not have complete control over a personal smartphone connected to the network. In that case, it is best to put those devices on a restricted VLAN.

You should always setup monitoring, detection, and barriers between the important things and the untrustable things on your network. If you ever find that it is impossible to do so, then your organization has a serious risk that must be escalated to management for resolution.


Can an attacker "simulate" a private IP address? I have a SSH server with a rule that does not allow password connections outside the local network.

So people already on the local network, either physically or via VPN, are allowed to connect with passwords but connections from external IPs must use a key (the weaker security for internal IPs is ok because if the network is breached, that server does not matter any more).

Would it be possible for an attacker who does not have access to the local network to "fake" his IP address and pretend that it is in one of the private IP ranges (or could an attacker have an actual public IP that falls in one of those ranges)?

Before the attacker can send any data to the SSH server, he has to complete a TCP handshake. This means the attacker has to guess a 32 bit sequence number. (If SYN cookies are used, the attacker's chances may improve.)

Assuming your server is generating good sequence numbers, this will significantly reduce an attackers ability to attack your SSH server using a spoofed client IP address.

But maybe you don't trust your server to generate good sequence numbers, or maybe you think 32 bit of security isn't good enough. So you might still want to know, what would happen once the attacker guessed a correct sequence number.

First of all we notice that the attacker will be able to figure out whether a guessed sequence number was correct or not. A correct guess will cause a connection to be opened, so it will count towards the limit specified using MaxStartups. The attacker can attempt to open another connection using a non-spoofed address in order to find out if that limit has been reached. He can keep your server just below that limit at all times, such that a successful connection with a spoofed address would always take the last available connection.

Without the trick to notice a successfully guessed sequence number, the attacker would have had to send password guesses in the blind without knowing whether the connection they were send across even exists. That could potentially have slowed the attacker down by a factor of 2³².

But even though an attacker can get feedback to indicate whether a sequence number was guessed correctly, there are other roadblocks preventing password guessing on a spoofed TCP connection.

During key exchange both client and server will choose a random value to be send over the connection. These random values influence the session key. This means an attacker working in the blind (because he doesn't see replies send from the server to the spoofed IP) will not know the session key.

The lack of knowledge about the session key means the attacker will have to guess a message authentication code. This is essentially equivalent to performing a MITM-attack on a legitimate connection. Additionally, the attacker has to send the password encrypted to be decrypted by the server. Since the attacker don't know the encryption key in use, he will not know which passwords he has tried.

The time window for the attacker to complete the attack only lasts until the spoofed IP address has replied with a TCP RST packet. Since the roundtrip time between attacker and server is likely going to be larger than the roundtrip time between server and local addresses, this could prevent the attacker from using any sort of feedback including the verification of correctly guessed sequence number.

You can give the attacker a longer window to complete the attack by installing a firewall that prevent the SYN ACK from reaching the spoofed IP address or by preventing the RST from reaching the server. This does however not make the attack much more feasible.


Erasing the contents of a photocopier hard drive, in such a way that the copier can use it again http://www.idtheftcenter.org/Identity-Theft/photocopying-sensitive-documents-you-might-want-to-think-again.html

How do I erase the copier hard drive if I take it out, without damaging it so the copier could use it again?

Do I have to take the whole thing apart, or is there an easier way (cable etc)?

This is for a HP Envy 5540 copier.

There's no other way. Open up the copier, take the hard drive out, use the linux shred command and the copier will be able to use it again.


I found a browser extension I don't trust installed, should I worry? Someone told me that their Firefox had a strange new menu bar.

I found that it was “FindYourMaps”.

  FindYourMaps is a deceptive browser toolbar that supposedly allows users to find driving directions and use various maps. Initially, this functionality may seem legitimate and useful, however, FindYourMaps is classed as a browser hijacker and a potentially unwanted program (PUP).

Source.

I uninstalled it successfully.

Should I worry about it? Could it have stolen some credentials? I used the Microsoft antivirus software to scan all the files and no threat was found.

The short answer: Yes, you should be worried.

There have been quite a few cases recently of malicious (or hacked) browser extensions harvesting user data, notably Catch-All last year, and the MEGA.nz extension being hijacked by hackers this year (and plenty of others, but that's enough examples to make the point).

Without knowing more, such as knowing how the extensions came to be there, and what permissions they had (see this question), it's hard to be certain exactly what the risks are. But assuming the worst is the safest option.

Malicious browser extensions are a serious risk to personal information and password security.


Security impact of MinSdkVersion on Android apps I know that defining a low MinSdkVersion for Android apps impacts the security of an app. From what I know, basically all security improvements since that MinSdkVersion are not enforced for this app, as it supports Android versions where it is not available yet.

For example if an app uses the MinSdkVersion 19 the mounted SD card is readable for the app.

Now to my question. Is there a list or collection of security implications for specific Android SDK versions?

For example, if the MinSdkVersion X is defined, the following security features are not guaranteed: [...].

Or something similar to check the implications of the chosen MinSdkVersion.

I know, basically all security improvements since that MinSdkVersion are not enforced for this app, as it supports Android versions where it is not available yet.

This is incorrect. minSdkVersion simply controls how old of an Android device your app can be installed upon.

  For example if an app uses the MinSdkVersion 19 the mounted SD card is readable for the app.

This is incorrect.

  Is there a list or collection of security implications for specific Android SDK versions?

No, sorry.


OpenSSH < 7.0 Multiple vulnerabilities question Nessus reports this as Critical however there are issues such as 'CVE-2015-5600' that CVE is 8.5 but Red Hat reports it as a 'Low' issue. https://access.redhat.com/security/cve/CVE-2015-5600 Reports it as 'Low' Impact. More over I dont understand why Red Hat says that is not affected from most of the OpenSSH vulnerabilities - any explanation ? For example --> https://access.redhat.com/security/cve/CVE-2016-1907 this doesnt affect Red Hat products... What are they doing differently ?

CVE-2015-5600: MaxAuthTries limit bypass via duplicates in KbdInteractiveDevices
This vulnerability has low impact on RHEL, because by default the option ChallengeResponseAuthentication is disabled in default configuration. Though it is or will be fixed in RHEL 6 and 7.
CVE-2016-1907: openssh: out-of-bounds read in packet handling code
This one does not affect RHEL systems, because the bug was introduced in openssh-6.8 (RHEL 7 ships openssh-6.6.1p1) as comment to the related bug.
Also other vulnerabilities can be similarly explained (usually because the the bug was introduced recently). Openssh is quite secure and breaking through all the levels of security needs a lot of effort.
Disclaimer: I work for Red Hat.


How to prevent a prophecy from becoming self-fulfilling or self-defeating Let's assume that I have deduced with a high probability what a certain famous person or organization will choose to do at a near-future date. How can I publish any proof of me having deduced this? The fact that they already have a plan now to make that choice at that future date might prove an unethical behavior or a conspiracy on their part.
I would like to ensure that I can prove that it was me who made the prediction, and that the prediction was indeed made before the event.

Of course, if I publish after the event that "I knew it!", nobody will believe me.

If, however, I publish it before the event, it might lead to the following problems:

self-fulfilling prophecy: people might accuse me that the event happened because of the information I published (I "gave them ideas").
self-defeating prophecy: they might become aware of their "plan" being discovered and change it, with me possibly ending up as a conspiracy theorist making wrong accusations.

Of course, I would like to choose the simplest method which works, using technologies the most people are aware of. This is very important, because if the technology used is very complicated, I cannot convince my audience if they don't understand my proof at all.

What I thought of so far, is the following plan:

I write the information as a simple, text-only file. I publish the MD5 hash of this file on twitter, social media, etc., with a short description of "this will happen", maybe with a short description of what a hash is and why I'll publish the information only later. After the event, I publish the "I knew it!" article, with a link to the previously published md5 hash. By using several social media sites to publish the hash, people can reasonably believe the date and time of the publishing. If I only published the hash on a personal website, they might assume that I tampered with the dates myself.

Is there a better way of doing this?

I know that md5 is partially compromised, but I guess it's still a good choice because:

it has a widespread use, if people have even heard about hashes at all, this will probably be the only one they know of. It also has a lot of implementations, so the average user can more easily check it.
although it is not completely secure anymore, because someone might forge a different file with the same md5 hash, it should not be the case with textual information. One might pad an executable with unused gibberish until it has the intended md5 hash, but I guess it's impossible to write a human-readable and on-topic text file without any gibberish in it, to make it have a specified md5 hash. Is this assumption correct, and is it likely to remain correct for the foreseeable future?

My approach has two problem areas:

Is it secure enough from an information security point of view?
Is it understandable enough that as many people as possible will believe my proof?

Please, if you have alternative solutions, keep in mind the above two different sides of the problem.

Encrypt your "prophecy" with PGP using a new keypair. Publish your encrypted prophecy on the internet for everyone to download. Make sure people share it, so they won't accuse you of creating a hundred files with every possible scenario and then making all but one of them disappear before you go public (like this guy). After your prophecy became true, publish the key to decrypt it.

Someone who did this for other reasons is Wikileaks and their "Insurance Files". This is a bunch of large, encrypted files. There is no statement what they actually contain. Wikileaks threatens the US government that should something happen to them, the decryption key will be released. They might be bluffing and it's just garbage. It might be just a PR gag. But who knows?

Possible weakness of this method: People might accuse you that you secretly gave your unencrypted prophecy to the decision makers and they did it just because they knew about it. Unfortunately there is nothing you can do to disprove this, because one can not prove that one does not possess a certain information (a dilemma faced by any person in world history who ever got tortured for information they didn't actually knew).


How to detect a database leak Website keep getting hacked every day and every now and then we hear website owners react and tell "affected users that their password might had been compromised". Most sites that disclose such leaks know exactly which information was compromised and it often only affects a small portion of the user.

In all my setups, I save everything in one single database. If a hacker was to gain access to the database, how can I verify what has been compromised.

My question is: how can I monitor my database for database leaks? There would be a few attack vectors: a user could find a bug in my code and gain access to my admin interface. In that case a log would help. But what if the attack manages to connect to my database and send any SQL query he wants? What if the whole server gets compromised? He could just delete the logs, or even hide his actions. This way, I wouldn't even know I was hacked until users start complaining.

In my setups I use Postgres but  I was hoping for mitigate/detection solutions that are not bound to one stack.

This is usually a combination of luck, technology and hand waving.

You may see that your database server was hacked (via unusual activity for instance, gigabytes being transferred to Internet, a fact detected by, say, your network provider). You may then have logs which trace activity on the database (ranging from "someone accessed the DB" to actual queries). You can then, hopefully, roughly imagine what has leaked.

Another example is the usage of Data Loss Prevention. This is a technology which had its glorious days a few years ago but failed to actually detect anything useful (generally speaking, it was looking for patterns in what is transferred). Taken into account the constraints you have to put in place so that it works, it is not surprising that you can hardly catch anything. But this is one technological possibility.

Another case is that you realize (or someone tells you) that your data is on pastebin.

You can see that there are plenty of possible scenarios.

Beside having your environment up-to-date, your main defense is to log everything, and do that in a place outside the immediate vicinity of your database (so that it stays there after the hack). You can use a home made solution (a centralized syslog server in a firewalled zone) or commercial ones (Papertrail, Splunk Cloud, ...). You then monitor these logs looking for unusual patterns.


What can a web application developer do to protect user information from powerful adversaries like the NSA or China Some well funded intelligence services with potentially untrustworthy employees intercept and store encrypted data for years, in hopes of cracking it with future technology. What can I do to make this more difficult for them, and how can I limit the scope of a successful attack? I already use SSL and store passwords as salty hash, with unique salt. I encrypt private data using the largest keys that the tools at hand allow, but I have no idea how much of a difference that makes against a quantum computer.

Some ideas that have crossed my mind:

Send some encrypted noise / lorem ipsum / random media before and after real HTTPS requests.
Implement a crazy PGP over HTTPS scheme. Public key exchange happens during the first real HTTPS request, after a few fake exchanges. Fake keys are kept and used for fake communication.

As you can probably tell, I'm not a security researcher, I just develop web apps for a small startup. I just discovered OWASP thanks to the "related questions" sidebar, I will be reading up on that.

As you can probably tell, I'm not a security researcher, I just develop web apps for a small startup.

That's your answer right there. Don't be a Dave an invent your own cryptography scheme. Just stick to known protocols that have been studied extensively. It appears that you are already doing just that.

Let's say that the NSA really has backdoors into every single cryptography protocol ever (it's just an assumption, it's most likely not true so relax....). What makes you think the NSA who hires a lot of very smart people cannot break your homemade scheme?

Just continue doing what you have been doing and you will be as secure as you are ever gonna be.


Heartbleed - Blown out of proportion? From what I gather you need local memory based access correct to even access the private key? Is all this talk and worry of "Was I hacked?!" "Heartbleed just made you full hackable" ect... really over exaggerating the issue?

For example I run some pretty big websites using SSL Certs for HTTPS. Am I really remotely exploitable to where everyone can see plain text passing?

The whole heartbleed story has gone way beyond sanity, for sure.

The bug is real and can be a serious threat to any server. However, the bug is no more serious than all other "buffer overrun" attacks, and arguably less serious than write overflows, which can more easily lead to hostile server hijack. You can have a list of reported security issues for OpenSSL on this page. None of them triggered such a panic as the one we are currently witnessing; yet some were of the "remote code execution" kind, technically much scarier than this heartbleed canard (but without the nifty logo).

The IT industry, as a whole, has come up with a strategy with handling that kind of bugs. It is called "apply the damn security patches from the OS vendor". This strategy is not ultimately elegant, but it works. There is no reason to single out this bug and award it a special treatment, as if it was a new kind of thing (it is not) or exposed to especially dire circumstances (it does not -- its consequences are within the normal range of security holes).

The only benefit of this pandemonium is that it shows who does his job properly. When a panicked sysadmin asks whether he should apply the fix right away and/or reset all his passwords and/or kill his dog (just to be sure), he implicitly admits that he does not usually apply security patches, or at least not promptly -- and that is the problem.


Why does a deauth attack work on WPA2 despite encryption? Given that WiFi packets should be encrypted if WPA2 is used, why is it that a deauth attack can be successful? Shouldn't the machine know that the message is illegitimate due to the fact that it would not be encrypted, having come from a fake source?

The use of encryption in 802.11 is limited to data payloads only. Encryption does not apply to the 802.11 frame headers, and cannot do so as key elements of 802.11 headers are necessary for normal operations of 802.11 traffic.

Since 802.11 management frames largely work by setting information in the headers, management frames are not encrypted and as such are easily spoofed.

To prevent deauthentication/disaccotiation attacks, the IEEE implemented the 802.11w amendment to 802.11. This provides a mechanism to help prevent the spoofing of management frames, but both client and infrastructure need to support it (and have it enabled) for it to function. You can find a bit more information on 802.11w in my answer here if you wanted to learn more.


Network authentication using router firmware scripting To connect to internet in our institute, you need to login with your credentials on a page and then approve the IP address for proxy less usage. On a router, if one device authenticates, all the other devices also get authenticated. So I want to know if I can authenticate from my router periodically.

If you are behind a NAT router where all connected devices get the same outgoing IP address and if the authorization against this specific site is solely done by IP address then it is enough that a single internal device behind the router will authorize itself against the external server because all internal devices share the same externally visible IP address.

This means that you don't need to run something on the router itself to automatize the authorization, but that you can run this on any of the internal devices. How this authorization can be automated exactly depends on how the authorization is done usually - and such information are missing from your question. But if it is just visiting some site and entering username and password then there are lots of command line clients or scripting languages which will help you there. But the exact details would be out of scope of this site, because they are just web site automatization and not really related to security.


How can I protect the confidentiality, integrity and authenticity of my communication if I am victim of a Man-in-the-Middle attack? Consider a scenario where my ISP attempts to use a Man-in-the-Middle attack against me to read and possibly modify my Internet traffic.

What can I do to access the Internet and still ensure the integrity and confidentiality of my traffic?

Furthermore, are there techniques I can employ to make it more difficult for the ISP to notice that I am trying to evade their Man-in-the-Middle attack?

Additional context from the comments: The ISP doesn't install a cert on my PC. Rather, I get a warning, and my only options are either to: A) skip the warning and let the ISP Man-in-the-Middle me; or B) stop using the Internet.

How to protect confidentiality and integrity?

Limit who you trust; encrypt everything.

Obviously, don't install any CA certificate imposed by the ISP. Consider removing certificates that are controlled by parties you do not trust.

At a minimum, make sure HTTPS is used for everything; you could even block traffic to port 80 and other HTTP ports to ensure nothing is leaked. Even with HTTPS, the ISP can still see the hostnames of the site you are visiting, thanks to SNI, if using TLS < 1.3 without ESNI. To mitigate this, only use TLS 1.3, and/or use a browser that supports ESNI. Problem is, not all websites may support these technologies.

The other major threat is DNS. DNS reveals just as much as SNI, but it also has no guarantee of integrity. Even if you change your DNS provider to something outside of your ISP, your ISP could theoretically redirect your DNS queries to their own servers and modify the traffic without any way to detect it. There are several replacements for DNS which attempt to mitigate the confidentiality and integrity problems, notable of which are DNS-over-HTTPS (DoH), DNS-over-TLS (DoT), dnscrypt, and dnscurve (note DNSSEC is not listed; it does not solve the problem of confidentiality). These protocols are all incompatible with each other and have varying degrees of standardization; it appears that DoH and DoT have gained the most traction. Various big-names have started promoting these protocols and have started offering them within browsers and mobile operating systems. These protocols can either be enabled individually on each device in the network, or configured on the router so that all devices speak normal DNS to the router, which then proxies the request using DoH or DoT.

But the above may not cover everything you do. To ensure more complete safety, use something that can tunnel all of your traffic, such as a VPN*, IPsec, or Tor (as written in the other answer, the ISP may have blacklisted known Tor nodes, so you may need to choose an entry node manually). Ensure that wherever the tunnel ends, it is beyond the reach of your ISP (e.g. don't set up a VPN tunnel to a friend's house that uses the same ISP), and it with a party that you trust (relatively). This depends on your exact threat model, so "free-VPN-that-collects-and-logs-all-your-traffic" may be acceptable compared to an ISP that is actively hostile.

If you own and control your own router (preferred anyway), you may be able to configure it as a VPN client such that all devices on your network will automatically use the VPN. If you do not control your router (i.e. ISP owned), connecting to a VPN from each device on the network will mostly mitigate the threat of the router.

*Most modern VPN providers and software will have pretty safe defaults, but VPNs can be configured without encryption as well, so don't automatically assume they are equivalent in all possible scenarios.

How to evade detection of these methods by the ISP?

This is definitely a hard problem, as it is fairly trivial to analyze network traffic. That is, changing the port you use for a protocol may not fool anyone (unless the traffic is encrypted and unrecognizable, and on a port that normally has such traffic). So, tunneling all of your traffic over a VPN on UDP port 53 may defeat some basic firewall rules, but deep packet inspection (DPI) will immediately raise red flags; port 53 is usually for DNS, which is a well defined protocol. Your traffic won't look like this at all.

Likely, the best option is to choose a port such as TCP 443. Still, it may be possible to profile the traffic and determine that it is not purely web traffic, with a decent degree of certainty, but it may not raise too many red flags since most internet traffic is probably over 443 anyway.

There are also ways to tunnel IP traffic over standardized, plaintext protocols such as HTTP, DNS (iodine), carrier pigeon, and ICMP (icmptx). While I do not think these may solve the problem (in fact, they could bring more attention to your traffic), they are interesting and perhaps relevant. I suppose there could be a scenario where your ISP forces you to use plaintext protocols that they can enforce and inspect with DPI. A VPN could be used to tunnel all traffic over another protocol while still conforming to the outer protocol's standards, thus evading the restrictions.

Summary

Require HTTPS and secure DNS
If this prevents your availability, e.g. the ISP forces HTTPS traffic to a proxy, use a VPN or Tor with manual entry nodes. The VPN may take some research or experimentation to get working; perhaps there are ports or protocols that are overlooked. E.g. perhaps TCP traffic is bent toward the proxy, but UDP is overlooked or mistakenly routed anyway (possibly only certain ports), but this is only a hypothetical misconfiguration
If all else fails, use application-layer encapsulation as a last resort. HTTP/DNS tunnels often still work behind proxies and forwarders, and may allow your traffic to pass through since it matches an allowed, cleartext protocol (but obviously your data would be encrypted). There may be some severe performance penalties to this method, but it can get you out of many a tricky scenario. This is not foolproof, it will still stand out and could be signatured.
Adapt to whatever they throw at you


How can I restrict my iframe to only use local content? How can I restrict my iFrame to use only local (i.e. not from other websites) content?  My question is the reverse of the question as how to restrict other sites from using my site in an iframe.

I am using Tomcat/Java/JSP.

You can set a Content-Security-Policy header with the child-src directive.
For example, this will only allow frame content from the same domain:
Content-Security-Policy: child-src 'self'

Instead of 'self' you can also specify a particular origin.
Here is a simple demo (the meta tag is used to simulate the header). Only the first frame should load:
<meta http-equiv="Content-Security-Policy" content="child-src http://example.com/">

Note that this works in Firefox and Chrome but isn't supported in IE and older browsers.


Store a password to avoid user interaction I am creating a windows service that sends email to a user. It uses a Gmail account to send the email, so it needs a password to access the account. It also needs to do this automatically, without user interaction. How do I securely store the password so that the application can authenticate with Gmail?

So far the options I can think of are:

Hard-code the password
Save the password in plain text file with restricted permissions

Neither of which is very secure in a Windows environment.

I think google's SMTP server supports OAuth, so you don't really have to store the password. That requires (one-time) user interaction to set up, but you'd have to ask the user to register anyway, so when you do that you can also establish OAuth link to Google.
See more in Google's help site.


how to configure windows login to get OTP as password I searched a little and understand that its possible,But i couldn't find any clue of how to do it.Also can i use any server that works or it must be something like SafeNet's blackShield server?
Also the only way to use OTP as password for login in windows was in offline mode according to some documents i saw.is there a way to use it as default?

PS: I'm a developer who works on a AAA application.We have a server for authentication.

Edit
What i'm looking for is not how to develop it.I'm looking for architecture model or a document that i couldn't find about what it needs and how to integrate the authentication server whether its developed by my company or any other company with windows.problem is i don't know what to look for.

the solution i found for this problem was to add a Credential Provider (CP) for windows to change the authentication type to OTP and then use Raduis to connect it to the OTP server or any autentication server that you want.
to be more clear what thing you need for this is the Credential provider.its conditions depends on you.
P.S : the CP i used was the PGina.


Preventing a Computational DoS Attack in Public Key Cryptosystems I'm designing a server which accepts anonymous messages using ECIES: as in, anonymous users send the server an ephemeral EC public key, and the server uses ECDH to derive a shared secret, and some KDF to obtain a shared symmetric key to decrypt the actual message.  The problem is ECDH, which is among the fastest key exchange available, is really slow.  From some quick tests, my computer can only handle about 3000 key exchanges per second.

An attacker could be constantly computing key exchanges and sending them to the server.  I'm not too worried about this if the attacker has actually done the key exchanges.  At least that way, the attacker will be doing as much work (slightly more with ECDH) as the server.  The problem is an attacker can send a garbage key and make the server do a lot of work doing the key exchange on garbage.  My first question is, in a reasonable implementation like OpenSSL, will the key exchange quickly return with an error, or take a long time doing useless computation?

Assuming the above is fixed, there are two more problems: an attacker could use the same ephemeral key over and over, keeping the shared secret but making the server do the key exchange repeatedly; and an attacker could precompute a lot of ephemeral keys beforehand and send them all at once.

One attempt at a solution to both problems is for the server to keep its own ephemeral keypair which changes every ~10 minutes.  It can publish its ephemeral public key signed with its permanent private key.  Then it would not be unreasonable for the server to remember the keys and corresponding secrets received during this period.  However, this doesn't really solve the precomputation attack because correctly generated EC keys will still work with a key exchange, they just would produce garbage data.  Is there any fast way for a server to know that a given key will actually decrypt the message?

Sorry for the long post, and thanks in advance to any comments.

It will take a long time doing useless computation.

One could conceivably use a designated-verifier non-interactive computationally

zero-knowledge argument that the rest of the message is well-formed.

More usefully, use proofs of work and PKE with fast decryption.


Digital Footprint Law Can anyone help me with the name of the digital footprint law? All I know is that it is named after its discoverer much like Moore's Law is. This is a computer science law that states for the purposes of encryption that all operations on a computer can be reversed which means that in theory all codes can be cracked. I had this information but errantly lost it. I could be mistaken but I think I first learned of this law in the Jeffery Deaver novel, "The Blue Nowhere" or perhaps the Dan Brown novel, "Digital Fortress". I know those aren't exactly academic textbooks but that may help jog someone's memory.

There is no such law, and the claim itself is false.

In a cryptography, there are irreversible operations such as XOR, which destroys information by taking two inputs but having only one output. There are also reversible operations, such as NOT, which takes one input and gives one output. It would be necessary to design a special, reversible version of otherwise irreversible operations. An example is CCNOT, which takes three inputs and has three outputs. If this is done, and all the outputs are preserved, then indeed secret cryptography would become impossible.

  This is a computer science law that states for the purposes of encryption that all operations on a computer can be reversed which means that in theory all codes can be cracked.

Counterexample: I have chosen two secret numbers a and b such that a + b = 37. Try to reverse it.

For a cryptographic counterexample, consider the one-time pad (OTP). It is perfectly secret because, given some ciphertext, the probability that it is the encryption of a given plaintext message is exactly equal to the probability that it is the encryption of another plaintext message. This statement holds true for all possible plaintexts and ciphertexts, without exception, when using a uniformly random key. The OTP theorem states that, if plaintext p is a variable with any distribution over {0,1}n and k is a uniform random variable over {0,1}n, then the ciphertext c = p ⊕ k is a uniform random variable over {0,1}n.

This answer only describes logical reversibility and not thermodynamic reversibility, which is another subject entirely.


CAPTCHA enough to thwart user enumeration? Say I have a site that has a user registration process where, when a user enters an email address already in use, an error message is displayed telling them that.  This seems like a easy way to a malicious user to enumerate users.

Would adding CAPTCHA to the registration process be enough to prevent user enumeration?

Yes!  In order for user enumeration in an account registration form to be at all useful an attacker will have to make thousands of automated guesses.  This vulnerability is not about informative error messages,  in fact even if you remove the error message you still cannot let two users occupy the same username.  By this general failure alone an attacker can determine that a username is in use.


Is it safe to connect a random USB battery from a bin to my phone without stopping data transfer in some way? I've asked the question Power-only USB connection to charge my phone - as simple as cutting the data lines? in electronics SE. In order to bypass the "Why do you want to do this?" request for clarification, I explained. Here is the first paragraph:

In a pinch I bought a $3 "phone recharger" from the bin shown below, but now I am too scared to connect it directly to my phone, which costs orders of magnitude more. While a poor design could present undesirable qualities to the 5V power output, I have no idea if there's something inside connected to the data lines - part of the 21st century USB angst that has many people saying "not in my USB port you don't". See this security SE answer for some background on USB angst.

I was repeatedly scolded in comments for wanting to be careful, e.g.

And what are you afraid of from the charger? What's it going to do? Tell your wife you've been looking at porn sites?

However there was some clarification:

You've also misunderstood the linked question on Security SE. Those plug in to a USB host and do nasty things to them by pretending to be a diffetent type if device. Your charger is the host in this case, and so can't present itself as any other device to your phone. It could (maybe) implement a host and install drivers (on itself) for the USB devices your phone presents, but it would have to be setup for a particular type of phone.
I'd be more worried about it damaging my phone than about some nebulous "security" problems. I repeat: What do you think it is going to do? Be more concerned about what facebook, candy crush, random programs from the playstore are spying on you than some piece of hardware that has no way to take use of any info it gets from you.

Question: I understand that buying random $3 phone chargers from a bin is foolish, and then having to ask about cutting the data lines in a USB cable is probably further evidence of this, but Android or iOS, is it safe to be picking one of these up and immediately connecting it to my phone? If it had an "extra chip" inside and it was preconfigured for a given OS, could it then do something that would raise issues of security?

Oh yeah, those comments you quoted seem to be to be woefully ignorant (and rather disrespectful since you have a legitimate question).

Welcome to the world of tin-foil-hattery!

Your fear that the battery pack may be more than a battery pack seems perfectly reasonable to me.

The comment is of course correct that the direction is reversed relative to the traditional BadUSB attack: USB Stick --> PC vs USB Power Pack <-- Phone, so your phone will not automatically install drivers supplied by the device. So BadUSB doesn't apply directly, but that by no means rules out the possibility of it exploiting a buffer overflow or similar vuln on the phone's USB packet parser.

It seems perfectly reasonable to be that the USB power pack could have a chip that exploits some unknown and unpatched vulnerability in the Android or iOS USB drivers (aka "a 0-day attack") potentially leading to full compromise of your phone. With both OSes trying to get increasing functionality out of that USB port, there's bound to be new code in their USB stacks, and as with all new code, there's bound to be some 0-days floating around.

As for mitigation

Apply the same reasoning you'd apply to plugging a USB stick into your CP: if you don't trust the device, don't connect it. Don't buy devices from dubious manufacturers, and always buy electronics in person rather than online for mail-delivery since the NSA has a proven history of doing this (and if the NSA is doing it, then they're surely not the only ones).

The NSA Actually Intercepted Packages to Put Backdoors in Electronics


standard operating procedure for pen test I have been asked to create a Standard Operating Procedure (SOP), to describe the phases of:
intelligence gathering, target profiling, vulnerability identification, target exploitation and post exploitation

I know what a standard operating procedure is but have no idea on how to create one.

Any chance you can help me to create one for these phases only?

Note: I am not asking you to do it for me instead I am asking for a tutorial or a guide you may know of or have come across which I can use to do it myself for these phases...thank you

Special Publication 800-115 Technical Guide to Information Security Testing and Assessment will help you in creating an SOP for security testing.


Building a backdoor for full disk encryption I have all my data encrypted on my laptop. All the backup hard drives are also encrypted. I know all the keys by heart and I could pick up any disk, enter the password and restore everything with it. As far as backup is concerned, this is nice.

But what happens if I have an accident and cannot remember the password? My whole digital live would be locked away and there would be no way to bring it back.

Also if I should pass away my relatives would have no way to get my accumulated data. There are vacation photographs they would probably want to have. And things like utility and phone contracts are probably very handy in order to sort things out afterwards. My parents might not even know exactly what I have contracts with (e.g. Spotify).

The data that I have is harmless and legal. So I am not trying to hide any crime, I just do not want somebody to steal my laptop (for the hardware) to obtain access to my emails and such. Same goes for my house, I do not want a thief to take over all my accounts after a physical theft. So its not really secret, it is just private data.

One way I thought of doing this is to give my parents some long random key printed out on paper to store in their house. Then I add this key as a secondary key to the encrypted hard drives. They cannot directly access the data as the computers are in my house but one could quickly get access if something nasty happens.

As my parents and I mutually exchanged house keys it would be technically possible to break into one house and find everything you need to get into the other house. But they would have to know to look for the printed keys at my parent's house. I find this rather unrealistic for the thief-for-money and if some adversary like this is up my back I guess I have bigger problems with online attacks.

Is this a good scheme to provide a backdoor to my encrypted files or is there some better way to do this?

(I am posting this with a new user as I do not want to give anyone ideas when searching for my name.)

Keeping the keys with your parents as plan to do seems safe enough. It is indeed unlikely that someone would break into their house, then yours, just to get your data. The most likely disaster scenario is that a burglar breaks into their house, finds your house keys, and visits your house next just because they now have the house keys - AND find the printed papers and the disk, AND decide to use it when they get back in their lair. But the burglar is not likely to type in a long printed key.... although they might try it, to see if it revealed credit card numbers.

You could perhaps mitigate this risk. Your parents probably have an alarm system, so maybe that could be used to warn you also when a break-in happens.

There are a few other solutions, but since the assumption is that you are no longer be able to find the data yourself, they all rely on trusted third parties.

A notary. You would put the keys in a box, either on paper or on a memory stick. The notary would keep the box. The box itself could be locked, or in the notary's safe, or both... whatever the notary and you agree on.
An n-out-of-m key scheme. Several of your friends/relatives get a partial key. You would use n-out-of-m because something could happen to one of them, and you'd still want them to be able to reconstruct the key if not all of them were able to participate.


How mobile app WiFiKill can cut off internet access to neighbor devices? There is a program for android- WifiKill which disables wifi internet access of some neighbor peers connected to the same wifi AP. How does this program work? ARP poisoning or some other techniques? Is there a similar one for laptop?  Is there a way to prevent such attack? Link to WifiKill.

WifiKill uses ARP poisoning:

  The app works only with rooted phones and works, similarly to FaceNiff, by spoofing ARP replies to trick other devices on the network into thinking your Android phone is the router. WiFiKill then drops all their network packets. To the victims, it still appears as if they are connected to the network, but the internet just appears to have stalled.

source

A similar program is Ettercap.


Owner vs IT employee. Security and passwords I own a company that has hired an IT employee. He has all passwords to servers, work stations and data. He is refusing to share or supply these passwords (Keys to the Kingdom) on the grounds of security. He has pointed me to your site along with many others, about the implications of sharing passwords. I understand the implications of sharing passwords among employees and vendors.  What is the best practice for securing passwords within a company?  What if he gets in a car wreck tomorrow? How do we manage changing passwords? How do we make all parties feel comfortable?  Most of all, me, the owner.

The way to solve this through a secret store.
Your IT person is correct in that you should not share passwords as is.
But you do have a claim to have emergency restore access form when someone gets under a bus or other catastrophic event (loss of memory for example).
Some of the ways to solve this are

use a Password manager service, with a secondary recovery option.
use a safe with a printed out recovery key, this would only give you (destructive) access back into the system and is only for emergency use. (Hence why it is in a safe)
have a distributed secret set, for example 4 hardware (smart card) tokens where you need at least 3 together in order to decrypt the master key stored on the system.
use something like hashicorps vault to store all the secrets, and use a shared token secret to restore access.
use a 3rd party to mange your access.

Just make sure you not only implement a recovery process (technically), but also implement a recovery policy, e.a. Write down when and why, who may trigger the emergency use. How it’s communicated (I prefer noisy recoveries, that will automatically notify all know administrators that a recovery is attempted and done.)
What you must NEVER do is

ask for the access tokens for a individuals account.
write down a password in clear readable form, always make it so it takes effort to recover it.
never test the procedure. (Make it so that you test the recovery procedure periodically, I usually recommend every 2 years or so.)
access an account without notifying the “owner”/“user” of that account. (This is called transparency, and is a corner stone of a safe and secure organization.

I hope this helps you get an idea.


How to evade a signature to detect "xp_cmdshell" for SQLi? What methods can be used to bypass a signature which detects "xp_cmdshell"?

If you're trying to get around a trivial filter that simply checks if the query contains the string "xp_cmdshell"...
and you're dealing with MSSQL...
and you know that xp_cmdshell is active...
and you know that the user has permissions to access xp_cmdshell...
and you need to specifically run xp_cmdshell, e.g. to prove an exploit, or validate the severity of the finding...

you have several options:

you can obfuscate the "xp_cmdshell" string, in several ways:
DECLARE @s varchar
SET @s = 'xp_' + 'cmdshell'
EXEC (@s)
Or, you can generate if from charcodes... etc.
If what you really want to do is get unrestricted access to the OS, there are other ways besides xp_cmdshell - there are the sp_OA*** set of procs (to instantiate COM objects), assembly access procs, etc.


Why is my Windows 10 machine listening for 127.127.127.127:3939? I was hoping someone out there could answer why my Windows 10 Machine would be listening on port 3939 using 127.127.127.127 over TCP?

I get the below with netstat -nat:

TCP    127.127.127.127:3939   0.0.0.0:0              LISTENING       InHost

Could someone help me figure out what this is?

I tried searching Google but came up with nothing, except some vauge references to VMWare (I am using virtualbox). Hoping someone here might know what this is?

A quick TCP port search hints at some ant-virus application related port. Since its listening to the local host ip-address it may be two processes of an application communicating to each other via local host-only TCP sockets.

You can find out the exact process ID by running this command as Administrator:

netstat -aon | find ":3939"

That should reveal which program is using this port.

Edited after discovering that PID 4 uses the port:

Typically HTTP.sys opens a local port on behalf of a system service such as IIS, SQL reporting server, print spooler, etc. These will all show up as PID 4.

Refer to these answers https://superuser.com/questions/352017/pid4-using-port-80 and https://stackoverflow.com/questions/1430141/port-80-is-being-used-by-system-pid-4-what-is-that to identify and try disabling the service corresponding to this particular port.

You could begin by trying to stop the HTTP service and in the process discover which other services rely on it:

NET stop HTTP


Gmail's "View and manage your mail" access I can see lately almost all 3rd party gmail apps/clients require access to "View and manage your mail". I know that they need this to delete emails, starring, labelling etc.

My question is, are the app developers (not the app) able to access and read my emails without my knowledge (I'm assuming google will send a new email when it recognizes a new login attempt from unrecognized device)?
Is it possible for them to do that as they don't have access to my password?

The developers will be able to read your email via the app. If through no other way than to put this "feature" into their application, as you read your emails they can make their application send your emails to them.

No they wont be able to login to https://mail.google.com as you, but they wont need to.


Differentiate between internal and external network calls We own a REST API which is consumed by machines on our own company network so we don't have any authentication right now. The plan is to expose the API to the internet using Apigee, while our internal network consumers also exist. What are the standard ways to securely know if a call was made from within the company network or outside?

Is IP based authentication a secure method to know if an API call was made from machines on internal network?
Our API's are written using the .NET framework and are running on Windows Server 2008 machine.

Is IP based authentication a secure method to know if an API call was
  made from machines on internal network?

What do you mean by secure?  What happens if a machine inside the network is attacked and used as a proxy?  Unlimited access to the API calls?

The REST API needs authentication and authorization before you can pretend it has any real security.  Of course those need to be done correctly, but that is on the lower end of what you need.


Loading of fake Library attack Let's supose i have an executable file a.exe and it uses stdlib for some operations.
Let's suppose an attacker changes the system stdlib to a "malicious" stdlib. The implications of this might be very bad, specially if the a.exe has SUID permissions. What are the main mechanisms already in place to avoid  fake code loading?

Code signing and ACL'ing the system locations are two mechanisms. windows won't load DLL's or EXE's that aren't signed by the Windows code signing key for system calls. Windows also periodically verifies the state of the files by making sure only code-signed file are present. Further, the default ACL's prevent writing to the system directories that store these DLL's and EXE's unless you're an administrator.

Windows has no real notion of protecting against administrators.


How do password managers implement secure browser integration? Some password managers can automatically fill passwords in user's browser. But for this auto-fill to be secure, they have to make sure they are putting password in the correct input field, plus, the information is not leaked to 3rd-party software. Here are some questions:

How do these password managers correctly identify the password input field on a web page? It may happen that a web page contains multiple password input fields. How does the password manager know which one it should fill in? If it puts password in the wrong field, is it possible for the information to be leaked (by some JavaScript event handlers, for example) even if the form isn't submitted yet?
Most of these password managers come in the form of browser addons. Does the browser have any security mechanism to prevent other addons to access the password information, before (when password information in the addon) and after (when password information on the page) it is filled in?
If there is a local password vault, then most likely it's stored as a file on the user's local filesystem. Since the password manager can fill password in plaintext, the local system has enough information to recover the password, regardless of what is actually stored in the password vault. But then wouldn't other programs on the user's local system also be able to recover the password?

How do these password managers correctly identify the password input field on a web page?

Password fields contain input type="password" in the HTML for the input field. This tells the browser and any associated extensions that input to the field should be treated as sensitive. This is what tells the browser to warn you if you are sending it over an unencrypted connection, and also what causes the input to be replaced with dots. In fact, if you edit the source of the page to remove this, you will notice that the characters you type in are not hidden anymore. A browser extension will be able to access this information as well (it is usually exposed in the extension API), and it uses this to determine which fields are password fields.

  Does the browser have any security mechanism to prevent other addons to access the password information, before and after it is filled in?

No. Any other extension with equivalent permissions will have the exact same access. They can see exactly what the password manager is writing to the input field, and will be able to see the password that is being sent. However, it will not be able to read the password database by itself, since one extension cannot read the local database of another extension.

  But then wouldn't other programs on the user's local system also be able to recover the password?

Yes, usually. While a master password may be used to encrypt these passwords, a local process running under the same user could easily hijack the browser to read the master key next time it is input. This is because a password manager's purpose is simply to let you use unique passwords for each website so you do not risk reusing the same passwords everywhere. They may add useful features like automatic password generation or encryption with a master key so someone who steals your computer cannot log into your sites, but that is not their primary purpose.

A browser password manager is designed to protect from a few threats, specifically:

A malicious or compromised website which can see the password you provide. If you use the same password for that site as for many other sites, that website will be able to impersonate you. A password manager allows you to seamlessly generate and use secure and unique passwords for every website you register on. A browser-based password manager simply makes integration with your web browsing experience easier.
An attacker who gains offline access to your password manager database, such as a laptop thief. If the password manager uses a master encryption key, which most do, then the thief will not be able to find out what passwords you are using. If the attacker is a local process running on the same machine, all bets are off. Password managers do not and cannot protect from such a threat. Proper system hardening and prompt security updates will.


Essential things to think about before outsourcing authentication with OpenID, OAuth, or SAML It's clear there  there is no consistent set of features among any of the popular authentication providers.

Below is an attempt to aggregate the similarities and differences I've noticed, but I would appreciate your advice on what additional features that are missing, and what are the important features to consider when looking at an outsourced provider.

Authentication

2 Factor Authentication Per Session (Google, Verisign , MyOpenID)

Blackberry, Android, iPhone, application (Verisign, Google)
Text (MyOpenID , Google )
Voice (MyOpenID via PhoneFactor, Google)
Browser Certificates, and Physical Token (Verisign)

2 Factor Authentication Per computer: Facebook
Beta (features subject to change) Yahoo 2/22/13
Force Password Change (LiveID every 72 days)

Privacy

Email Address Hidden/Not Shared (LiveID, ClickPass)
Offers a unique ID per website (ClickPass )
Information Sharing Controls (Yahoo, Facebook, Google, LiveID, LiveIDServices)

Forgot Password Feature

Most Secure (Google has Phone, OTP, and a difficult survey to fill out)

Delegation Support

Verisign
ClickPass
(many others)

SignIn Seal / SiteKey

Yahoo (read about how this ineffective here)

View Authentication History

Full Logging of date, action, and target MyOpenID
Good logging but inefficient for auditing access Facebook
Limited to Grant and remove authentication Google, Yahoo

Active Session Summary

See What information should be shown for an active session summary

End user features

Easy sign in/sign up process (Aol)
Option for "difficult" sign in process to improve security (Verisign), also see this related question

Supports Connected Accounts

Google
Yahoo
LiveID

Token Replay Protection

ADFS  (also see WIF for RP protection)

Connection Security

HTTPS Support with LiveID and Facebook

Question

  Did I miss any important application features?
   Are there some features I shouldn't pay attention to when comparing providers?

Some examples of additional information that is missing in this list include encryption specifics, ISO/SAS70 certification, or if the providers are using DNSSec.  I could use help in gathering this information, and prioritizing what's important and not.

Please share additional info, or correct mistakes as you see fit.

The right answer will clearly depend on your application.

For example, you've listed:

  Option for "difficult" sign in process to improve security (Verisign), also see this related question

Using a provider like this would be a terrible choice for a site with low login security requirements and a strong desire for low barriers to entry in order to gain user base -- say a stackexchange or twitter. On the other hand it would be a benefit to a site that needs to perform financial transactions.

To some extent it will also depend on the combination of your users' preferences combined with the reputation of the provider. If you force users to use, say, Facebook, in order to sign up then you may lose users who have shunned Facebook. Or google -- they already have enough data about me, why would I want them to know every time I log in to your, say, dating site?

Lastly, I think one "feature" you are missing is the history of actual (versus promised) security. If a given provider has had a series of failures, it's likely they will continue to have failures. This is not to say that a provider with no known vulnerabilities will not have some exposed in the future.


Why do some known vulnerabilities have no CVE ID? Why do some known vulnerabilities have no CVE ID? And why does some vulnerability have a CVE ID assigned but no information on cve.mitre.org or cvedetail.com?

Why don't some vulnerabilities have CVE numbers?
It's usually either that the entity who found the vulnerability didn't care to request one, or that, for some reason, a CVE Numbering Authority (CNA) or MITRE themselves decided not to include the vulnerability in the system.

Why are CVE entries sometimes empty?
The CVE number  assignment procedure specifies that the CVE number requester should notify MITRE about the public advisory, and then MITRE would update the CVE entry. Sometimes a CVE requester (usually a vendor) would ask for a CVE, and then neglects to notify MITRE, release an advisory containing a patch without any details, or simply just delay informing MITRE. In these cases, the entry will remain mostly empty until the requester provides more information.

In any case, it's up to the CVE number requester to request the number and then provide information to be filled in the entry.


How can I easily determine if a website security company is reputable? Is there a BBB-type listing or some other reputable badge I should look for when choosing someone to perform a security review?

Even reputable companies sometimes give useless or counter-productive feedback; many times it comes down to the experience of the actual representative you talk to. Just search this site for questions dealing with PCI-compliance audits to get an idea of how perfectly backwards some well-established firms can be.

But in the end, what you really need isn't an audit, it's training. An audit is just a snapshot, and it's value disappears almost immediately. But if you can get a firm to act not as an auditor but as a consultant, training you in the proper way to secure your business, then you'll have something of lasting value.

Also, consultants are much easier for you to rate. If you're not learning anything useful from your consultant, then clearly he isn't very good. Try out a few and decide whose style you like, and compare their advice with what you see on this site. It should be pretty straight-forward if you put a little time in to it.


Is there a security benefit to be found in using a virtual machine if the host is infected? What I have found out so far is that keyloggers, for example, can still capture what you type, even within the virtual machine.

I could not, however, find much information regarding other effects of an infection of the host system on the virtual machine. The keylogger thing alone could be easily circumvented by using something like the on-screen keyboard that comes with Windows.

If an attacker could just read whatever you type or copy into your clipboard from memory, however, you might not even bother. So I ask you: Is there a security benefit to using a virtual machine with a potentially compromised host machine?

There are multiple theoretical situations where your actions in a Virtual Machine would be hidden from garden-variety malware. For example, banking trojans wouldn't know how to inject themselves into your browser that's running in the virtual machine. Although in theory malware can record your screen in HD, usually they don't want to play babysitter.

Additionally, Windows 10 has a feature called Credential Guard that leverages virtualization to protect a certain type of secret key, even if the computer is infected.

Windows Server 2016 also has a feature called Shielded VMs.

However these are edge cases with their own debates about the scope of what they address. For all intents and purposes, in the real world if the host machine is infected, all attached virtual machines should be considered compromised as well.


Can zip files be cracked if they were split into parts and only one part was available? I am talking here about zip files that were compressed using basic protection and those using AES protection. In both cases, if only one of the many parts of the zip were available, will it be able to crack it?

What you describe here is called a known-plaintext attack. The attacker has at least part of the plaintext, and tries to use it to figure out the key.

AES and all other modern encryption algorithms must be able to withstand this type of attack. So the answer is no.


Ensuring a web-service only processes requests from specific computers I'm in the process of designing a system that consists a client application and a single web-service. The client is distributed on several machines (installed by me or a colleague), and the communication between client and server is over the Internet.

What I'm looking for, is a way to ensure that the web-service can only receive requests from those physical machines that I originally installed the client-application on.

The computers will be running some kind of Windows, I'm not exactly sure which edition yet. And the web-service will be WCF-based.

My current thought is to install a client certificate on the machines, and use that for authentication on the web-service. I'm unsure of how or if there is a mechanism to lock the certificate to the physical machine, or just password protect it in order to prevent it from being exported and installed on another machine.

My knowledge of certificates is very basic, which is why I am asking if this seems like a viable approach, or if there is another way that would work better.

Edit:
I realize that my original question was a bit vague about how secure I want this to be.

The client-application may be considered as a daily annoyance to the users that are forced to use it. And one of the points with the application, is to be able to tell that a person was at this location/computer at a certain point in time. So I want to be able to tell from my web-service that the request did not originate from "my machine". This is all in order to prevent the "annoyed user" from thinking up schemes to avoid having to be at the location where the client-app computer is located. Such as simply copying the application to a laptop computer.

So, it is more about preventing the simple ways to get around using my installations of the application from one of my computers. And the user type isn't someone with an IT background.

Thanks for the many helpful answers so far

How concerned are you about an insider threat and how savvy would you expect insiders to be?  That's your biggest factor.  Almost any security mechanism you put on the machine's hard drive can be cracked if the attacker gets a hold of or too much access to the hard drive.  How long that will take will be a factor of how well you've secured the drive.

I can think of a lot of ways to do this:

IP filtering (spoofable)
set up IPSEC tunnels during install
Certificate based authentication
Require VPN authentication with something like a pseudo random key generator on a token

Anything is hackable, given the right threat.

Each mechanism has different ways of being attacked or compromised.  IP addresses can be spoofed, IP Sec tunnels or certificates can be compromised if the attacker gets into the hard drive or people do something dumb with the computer's security data.   Key generating tokens are great for being separate from the machine, but it requires COTS software and can get pricey.

Certificate authentication via client authenticated SSL is usually not too bad to configure - web servers will do a very simplistic authentication scenario, and you should be able to restrict your server to a list of clients that you trust based on the certificate's distinguished name.  If you use software certificates, it means you will have to install a separate private key for each client.  That means some level of diligent key management.  You can upload private keys into browsers or other certificate stores with a rule to the OS not to export the private key.  Some of this can be hacked or changed depending on the user's privileges, thus the question of insider threats.

If you limit your certificate authentication to SSL client auth, you won't have to change any of the logic of your web service unless you also have more specific privilege management requirements.


SQL Injection Attack - Permissions Defenses SQL injection attacks work by the attacker putting valid SQL into the text that goes back from the page to the server; something like "Delete * from tblAccounts where 1=1"
What I cannot understand is why this cannot be defeated by giving the account that a web user's post runs as read-only permissions.  Not only that but read-only on only the tables you want him to read, and no access at all to any other tables.
In the past one could give very granular permissions in databases, down to row level.

An SQL injection adds a new SQL command to the command the website uses to retrieve / update / add data to the Database.
Since nearly all websites that use a database need to have some tables to write in the attacker can always add data there.

More importantly, most of the time the database holds information not available to all users of the website (like for example the user table with usernames email addresses and passwords (-hashes). a table the website itself uses (so needs access)

When security in depth is applied you do lock the database user the website uses for access to only those the website needs access to (as limited as needed)
This does not eliminate the risk of an injection, just limits how far it can spread. but all tables available to the website are available to a injection user when SQL injection is not mitigated.


Possible setup for a direct democracy voting system to prevent fraud My Government is designing a direct democratic voting system and would like the system to be open sourced and unable to be corrupted by individuals and other stakeholders.

Some requirements as of now:

Citizen individual votes shall remain private.
The system must not be corrupted by (those?) running the system.
Vote results must not be changed by the system.

Open source code is an obvious part-solution, but how would you ensure that the correct code is used on the production live voting server?

In a perfect way you can't. There is always a group of people that could conspire to rig the system. It isn't feasible to allow every member of the public the opportunity to manually vet and observe each step.

So what you do is form a group made up of representatives from each party. In this way you know the group are extremely unlikely to rig anything because they would be unable to decide on a result to rig it to.

Another feature which can aid is to pubish a full vote log in a way where each voter can verify their own vote is shown correctly. This can be done either by assigning each voter a unique private ID or using cryptographic signatures and assigning each user a private key. The downside of this is voter manipulation (I can threaten you to vote a certain way. In a paper/booth voting system you can vote differently and lie to me) - but with an online system someone can just stand over your shoulder and watch you vote anyway.


When will it be feasible to enumerate all possible private/public key pairs One way to defeat public key encryption would be to make a list of all public and private key pairings. For 128-bit and 256-bit keys, there are lots of possible pairs:

2^128 = 3.40e38
2^256 = 1.16e77

Google might have 15 exabytes of data storage (1.7e17). They'd have to increase that capacity by more than 10 billion to store even just the 128-bit keys (which are perhaps not used much).

On the other hand, it's a problem of scale rather than computational difficulty. Is there anything to stop the NSA (or its international counterparts) from simply brute-forcing it? How would we know?

I think you have a fundamental misunderstanding of this aspect of crypto. Firstly, public/private keypairs are not bruteforced, those are typically factored. And they come in sizes much higher than 128 or 256 bits. They are much more complex to understand than symmetric crypto. You seem to be talking about symmetric keys, which do not come in "key pairs" but are single keys that work both ways.

Secondly, 2128 is much more than 3.40e28. I'm not sure where you got that number. The fact is, there is no possible way to store that much. To put it into perspective, there are only roughly 1080 proton masses in the entire universe, which means that even if every single proton and neutron stored a single bit, we could only store roughly 10^80 bits of data. Even if all the grains of sand on the earth could store a bit of data, you still couldn't store 2128 in it.

You also have to remember that each key is not one byte, but 32 bytes (for 256 bit keys) or 16 bytes (for 128 bit keys), which adds up to a lot more, though even if it were a single bit each, there would be no possible way to store it all.

There are many questions and answers all over the internet explaining how long it would take to look through even a 2128 keyspace, and why it is so utterly impractical with classical computers. I suggest you read through some of those.


How could criminals use stolen EMV credit cards in 2011? I would like to recall a fraud happened in France in 2011 for which a paper was published (also linked from Ars). I came onto this by following debate on EMV card security and its mandatory introduction in the USA. I live in Europe anyway.
This question is directly related to the specific fraud and must be contextualized into year 2011, as this technique is mitigated. This means that the question is not actual.
Summary
By adopting a sophisticated MITM technique, physically implanting a proxy chip onto a real stolen card's chip, criminals were able to completely disable user authentication via PIN code and perform transactions using stolen credit cards.
After the fraud was discovered and cryptoanalyzed, a number of fraud prevention enhancement were deployed to POS system and card protocol to defeat this technique.
Interesting quote from the article

The reason we started our research was that people came to us again and again claiming that their cards had been stolen and used in store transactions which the banks swore proved that they'd been negligent with their PINs, while the customers were certain they could not have been.”

My question
How was it ever possible that a stolen card was usable for months?
Since the very introduction of EMV cards (a long time for us Europeans) all banks getting reports on stolen cards would first disable the card itself, and in real time. Credit cards could be physically stolen (like the 2011 fraud), or their PIN compromised, namely coerced.
In both case, a POS machine from year 2011, while accepting a card that passed PIN verification, would get a clear rejection from the payment processor, as the card is supposed to appear in the blacklisted cards, or not in the list of enabled cards.
How was it possible that those transactions were accepted and processed? The article clearly speaks about stolen cards, and I don't think that all 40s of cards were stolen without the cardholder knowing that. And also I am not talking about a card stolen and used as quickly as possible before the cardholder calls the bank to block the card.
All of our banks since earlier than 2011 offered a free-dial number to report stolen card. The card is blocked immediately (ATMs may also refuse to return the card to the presenter) and the bank will later issue a new EMV card with a new PAN and a new PIN. I had to block my stolen EMV card once, so I have direct experience with this. It was never used by who got it, as it was PIN protected, but anyway I got my old card blocked upon phone call, and after a few weeks a new card with new number and code was issued to me.
I have read the entire paper I linked and could not understand how could that fraud scheme be effective against payment processing banks. Unless at that time the payment processor did not check for the card to be active, relying on its advertised expiry date (stored in the chip) and PIN authentication result.
The sense of this question is that, theoretically, an EMV card with compromised PIN reported stolen could be (or could have been at the time) used further! I know about a small number of PIN coercion cases in my country.

One of the features of EMV is that a transaction can be approved offline by the chip, if neither the chip nor the terminal flags it to go online.   The terminal simply stores the chip's response, and sends it to the processor as part of end-of-day settlement.   Some terminals aren't even capable of online approval, although I don't know how common that is.

This is an advantage for the merchant, because they can process transactions faster and/or without having to dial into a processor to approve it online.  The only advantage to the cardholder is speed.  I presume the issuing banks have some advantage, but I'm not sure what it is.  If you assume that EMV cards cannot be copied, or used by someone else if stolen, it's just as safe as approving online.

All this is to say, if they were using the stolen cards for  amounts below the floor limit configured in the terminal, it is very possible that they were not authorized online, and thus not flagged as stolen at the time.  It's only at the end of the day that the merchant would discover that it was a fraudulent transaction.

In recent years, has connections to the processor have gotten better in Europe, more transactions are being processed online anyway. I know that Visa recently mandated that the floor limit for visa cards should be reduced to zero, forcing every visa transaction to be authorized online if possible.


Ysoserial and Jenkins commons collection exploit - what can you do? I have read about the Jenkins exploit of the Commons Collections vulnerability. I've tested this (legitimately) on a system, but I'm not very good at this, so I can't seem to achieve much. What is the worst case scenario if someone takes advantage of this vulnerability? What is possible to do?

Just read on in the same article and you will find:

  This vulnerability is amazing. Runs in memory and isn’t going away anytime soon. Remote code execution in many many things including custom applications

So this vulnerability will allow remote execution as a non-privileged user in many cases. From there is is often possible to elevate the privileges, i.e. to super user and maybe to attack other machines in the internal network.

Of course this needs malicious user input. If you can guarantee that no such input is ever sent to the application then you are probably safe. You probably cannot guarantee it for public installations. You might think you can control it for internal installations but I would not count on it, because internal and external applications are usually both accessed by the same browser. And using CSRF , XSS or similar attacks an external site can harm an internal site by using the browser as a trampoline.

  What is possible to do?

This is also explained in the The Fix - Kind of... part of the post. In effect, you need to fix the relevant library, replace the library with a fixed on inside your application and roll out the application everywhere.


SSH ED25519 Key Extract pk (32 bytes) I am playing around with ssh keys with ED25519.
I have seen a couple of libraries playing with generating the public/private key pair. Another parsing the openssh private key to get the key, but the challenge I'm running into is getting the pk value from the public key.
From OpenSSH https://github.com/openssh/openssh-portable/blob/master/PROTOCOL.certkeys
I find this:

pk is the encoded Ed25519 public key as defined by
draft-josefsson-eddsa-ed25519-03.

So I am trying to get the actual public key value (32 bytes) from the public key, and then encode them.
My question(s):\

Can someone explain how to extract the actual public key from the the ssh key public key (removing all the extra stuff and leaving just the key)?

Could someone put in human speak (or code) an example of encoding the public key?

(I'm doing this in python, cryptography.hazmat doesn't support this yet. I've waded through the C code for openssh keygen signing, which needs the pk, and I'm not familiar enough with C to dig through the pointers to pointers, etc to figure out well enough what it's doing.)
Happy to do more research if needs be, but just looking for a next place to look.

1- Can someone explain how to extract the actual public key from the the ssh key public key (removing all the extra stuff and leaving just the key)?

The format of public key is described as the part of known_hosts section of manual page for sshd:

  keytype, base64-encoded key, comment.

So lets create a key to see what is there.

$ ssh-keygen -t ed25519 -f ed25519
$ cat ed25519.pub
ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIE8C+wgMJ89PV5cQZxfCpq+GB/gZ0zO7JQhnVBIh2gOj comment

Using cut we can select only the key blob, which is LV (length value) structure, containing (once again) key name and then the actual PK value:

$ cat ed25519.pub | cut -d' ' -f2 | base64 -d | hexdump -C
00000000  00 00 00 0b 73 73 68 2d  65 64 32 35 35 31 39 00  |....ssh-ed25519.|
00000010  00 00 20 4f 02 fb 08 0c  27 cf 4f 57 97 10 67 17  |.. O....'.OW..g.|
00000020  c2 a6 af 86 07 f8 19 d3  33 bb 25 08 67 54 12 21  |........3.%.gT.!|
00000030  da 03 a3                                          |...|
00000033

We can once again get rid of the key name to get the string representing the PK only. The Length is represented always using 4 bytes: 00 00 00 0b (11) is the length of the ssh-ed25519 string (hex: 73 73 68 2d  65 64 32 35 35 31 39) and then follows the PK length 00 00 00 20 (always 32 bytes) and the key itself (hexadecimal):

4f 02 fb 08 0c 27 cf 4f 57 97 10 67 17 c2 a6 af 86 07 f8 19 d3 33 bb 25 08 67 54 12 21 da 03 a3

  2- Could someone put in human speak (or code) an example of encoding the public key?

The above is bash and manual version of extracting the PK value from OpenSSH public key. I believe you will be able to implement that in Python from the above description.


Steps to Become PCI Compliant? I have a small business, and I'm in the process of building a new website.
My card processing company says I need to be PCI compliant. I know I did this once before years ago and had the Compliance Seal on my site, but now i'm getting sent in circles trying to get my site compliant.

Can someone please give me the steps to achieve compliance?

The PCI Security Standards Council has (defines!) all the steps to be compliant:

How to be Compliant
Getting Started

And many others including the Self Assessment Questionnaires that you must complete (and can use as a guide to seeing what you need to secure).


How to read dmarc record for a report? I have a dmarc file containing some record. I am bit surprised by the result and I would like to make sure I am reading it correctly.

Here is the record:

<record>
      <row>
         <source_i>1.2.3.4</source_ip>
         <count>1</count>
         <policy_evaluated>
            <disposition>none</disposition>
            <dkim>fail</dkim>
            <spf>fail</spf>
         </policy_evaluated>
      </row>
      <identifiers>
         <header_from>mydomain.com</header_from>
      </identifiers>
      <auth_results>
         <spf>
            <domain>anotherdomain.com</domain>
            <result>pass</result>
         </spf>
      </auth_results>
   </record>

If I am correct, this means that:

this <source_i>1.2.3.4</source_ip>: the mail was sent from 1.2.3.4

this  <count>1</count> One mail was sent

this <disposition>none</disposition> No policy where apply to that mail.

this <dkim>fail</dkim> <spf>fail</spf> spf and dkim for that mail failled

this  <header_from>mydomain.com</header_from> is the source in the mail header

The other
<domain>anotherdomain.com</domain> the mail was sent to  anotherdomain.com

<result>pass</result> the email passed dmarc check.

can you please correct me line ?

What is auth_results are DKIM and SPF results, uninterpreted with respect to DMARC.

What is in the policy_evaluated are the results of applying DMARC. disposition is the policy action specified in DMARC record. dkim and spf are DMARC-aligned authentications results.

Hope it helps.


Does ISO 27001 allow cloud based Spam/Malware filter solutions We are currently switching over to Exchange 2013 and we are thinking about outsourcing the spam and malware filtering to Microsofts Exchange Online Protection. Its implemented by changing the MX Record of our domain to the address of their datacenter.

This would be a very practical and also relativley cheap solution for us. But we are also thinking about an ISO 27001 validation. Is the outsourcing of spam and malware filtering compliant to ISO 27001?

There's nothing in ISO27001 that would specifically preclude what you describe.

At a high level provided you have conducted a risk assessment applicable to the use of the email proxying service and the 'output' is consistent with your risk acceptance criteria it will not be incompatible with ISO27001.

Thinking more about specific control areas, as a starting point there are relevant controls/advice in 'Supplier Relationships', there are likely others that will have relevance as well (refer to the standard and decide based on the proposed solution).

Also, since you appear to be within the EU, you may want to ensure you have covered data protection requirements in the contract with the supplier (Microsoft should have standard contract clauses that are compliant with EU data protection requirements).

If you do not already have a copy I would recommend getting hold of ISO27002 which provides more detailed explanation about the controls in ISO27001.


The Spring Security framework recommends against using double-submit cookies to prevent CSRF. Is their concern legitimate? I was about the Spring Security framework's CSRF protection to see how it works. Spring doesn't use the double-submit pattern, but instead associates the CSRF token with the user's session. The documentation includes the following explaining why that is:

  One might ask why the expected CsrfToken isn’t stored in a cookie. This is because there are known exploits in which headers (i.e. specify the cookies) can be set by another domain. [...] See this webappsec.org thread for details on how to perform the exploit.

The gist of what the webappsec.org thread says is:

Attacker puts Flash document on attacker-controlled website, user visits it
Flash app makes a same-origin request to the attackers website which sets the target header, and this is permitted by the crossdomain.xml on the attacker's website
The attackers website responds to this request with a 302 or 307 redirect to the target website
Flash (in "certain circumstances") ignores the target website's crossdomain.xml and makes the request to the target website with the extra header included

My question is: is this a valid concern?

I was unable to reproduce the problem by following the steps in the webappsec.org thread, and furthermore it sounds like this was a straight-up bug in Flash itself rather than any vulnerability with the double-submit cookies pattern. Although this problem resulted in at least two CVEs against web application frameworks I could not find any corresponding bug filed for Flash - but it seems like either it has been fixed since, or I was not correctly reproducing the unspecified "certain circumstances" under which this happens.

This issue was specific in nature, and has since been patched out of Ruby. Flash was more of an example of how one can exploit this issue with a browser plugin, a good example too given it's probably one of the most common plugins, but the actual flaw was in Ruby.

We are also talking way edge case that an attacker could pull this off.

There is really nothing to see here unless you are playing with unpatched versions Ruby.


Which encryption algorithms will be used to replace RSA when quantum computers become common? Possible Duplicate:
  Are the encryptions "broken" with great computing power?

I just wondered which algorithms will be used once quantum computers become common. Are there already existing algorithms that don't rely on factorization problems and thus could replace RSA when the age of quantum computers starts?

The eminent programmer and cryptographer Daniel J. Bernstein has a page dedicated to that.  The shortest version:

Hash trees, NTRU, McEliece, and multivariate-quadratic systems.

McEliece, for example, is immune to quantum speedups because it relies on "the hardness of decoding a general linear code (which is known to be NP-hard[4])." Since NP is not in BQP, NP-hard problems remain hard; even with practical quantum computers.


Rotating TLS Certs used with Public key Pinning I have an app which connects to an API. The API TLS certificate is about to expire and we are using Public key Pinning.

How do I rotate the certs without disabling access to our users?

When rotating certs; can I change the private key without changing the public key? I assume no as they are a key pair. Can someone confirm?

What would be the point of rotating the cert only to update the expiry date? Surely someone investing sufficient time to compromise the private key can continue to do if only the expiry date variable is changed?

I understand if it coming close to expiry I should update the cert to prevent unavailability of the service but then is it recommended to have a long expiry date on the next rotation?

When keys are rotated (say I leave the public and private key the same); is there anything mathematically or from an encryption perspective that changes if only the expiry date has changed?

can I change the private key without changing the public key?

No. You can reuse the same private and public key for another certificate but you cannot switch only the private key and use the same public key. If this would be possible then pinning to a public key for security would also not make sense.

  What would be the point of rotating the cert only to update the expiry date?

What is the point of ending a certificate in the first place? To have the ability to create a new key and maybe adapt to a better key algorithm if needed. And because the owner of a domain might change so the previous owner (who has the private key) should no longer be able to (mis)use a certificate for a domain it no longer owns.

Of course, this could be done with certificate revocation. But revocation does not scale since more and more revocation information would have to be stored and checked. An expiration thus provides a way to cleanup older revocations (since the certificate is expired anyway) and with a short expiration it also limits the impact if revocation is not properly checked in the first place - as it is unfortunately the case with most uses of TLS.

Thus, it is not necessary to create a new key with each certificate but it is good to have the option to create a new key if necessary.

  ...  but then is it recommended to have a long expiry date on the next rotation?

It is better to have short expiration but change the key only when needed. And in case of public key pinning one should also have at least a second key which then gets used for the new certificate in case the first key was compromised.

  When keys are rotated (say I leave the public and private key the same); is there anything mathematically or from an encryption perspective that changes if only the expiry date has changed?

I'm not sure what you mean. There are no changes to the keys but the certificate is newly signed by the issuer to proof that the existing information in it are still valid. Thus at least the expiration time and the signature on the certificate has been changed.


WordPress is asking for my FTP password to update. Is this official behavior or am I compromised? I'm running a personal WordPress server and I have 3 pending updates:

WP update from 4.2.2 to 4.3.1.
Akismet plugin update to 3.1.5 which addresses XSS issues.
Twenty-fifteen theme update.

For each of these update types, WP is prompting for my FTP password. The page looks clean and there is an assurance (?) that my password will not be stored anywhere. The HTTP headers look clean but I can't be sure as I'm not really a security professional and I have very basic protection on my personal website server; not production-quality server toughness.

However, I'm still wary about all this. Why, after all this time, will WP suddenly need my FTP credentials? Moreover, I can't find any official mention that WP will now be asking for my FTP credentials for updates. Lastly, even if this is official and secure, isn't this vulnerable to man-in-the-middle attacks? My credentials can still end up in the wrong hands.

Or am I compromised? How do you suggest I address this? The updates are still pending and I have not given my FTP credentials.

Wordpress asks for FTP credentials when it does not have write permissions to the Wordpress installation during installations or upgrades.

To avoid having issues with Wordpress asking for FTP, simply change the privileges of the Wordpress installation so that the user that the webserver is running under can write to the Wordpress installation.


HSTS on a subdomain with includeSubdomains Suppose that my site is located at foo.example.com and I send the following HTTP header when visitors accessing my site using HTTPS:

Strict-Transport-Security: max-age=31536000; includeSubDomains

Would the HSTS policy have any effect on domains such as example.com or bar.example.com?

I'm not in charge of the certificates but the common name is *.example.com on the certificate so I'm not sure if that matters.

The certificate isn't valid for abc.foo.example.com, but I imagine that if there is a valid cert for such a host that the HSTS policy would apply there.

Based on the RFC, HTTP Strict Transport Security (HSTS), the includeSubDomains states:

  6.1.2.  The includeSubDomains Directive

  The OPTIONAL "includeSubDomains" directive is a valueless directive
     which, if present (i.e., it is "asserted"), signals the UA that the
     HSTS Policy applies to this HSTS Host as well as any subdomains of
     the host's domain name.

Therefore your HSTS policy would only apply to foo.example.com and *.foo.example.com

example.com and bar.example.com would not be impacted.

For more info, there is a great thread on webmasters titled Do I need a wildcard SSL certificate for inclusion in the HSTS preload list?


Is a cryptographically signing camera possible? What kind of digital / cryptographic signing would make it possible to create a camera that cryptographically signs the photos it takes so that the images can be verified to have been taken with that specific camera?

The motivation is that if the camera is able to implement a trust system, then it would create the ability to trust that photos or videos that it creates have not been subsequently modified.

Some potential variables:

Would it be preferred to use a single signing key for all cameras of a specific model, vs. keys for each instance of the camera, and how to limit the ability to extract/steal those keys. I guess this might involve a Trusted Platform Module, but I'm not knowledgeable about hardware security.
Out of scope for this question: The trust would be limited by the ability to present false image data to the camera at a stage prior to the signing step, using hardware hacking or simply holding up another image in front of the sensor.
Instead of implementing this as hardware, implement it as a smartphone app and take advantage of existing platform security.

As  @ThoriumBR stated, yes it’s possible …

Like so many things, while the concept is straight forward, the details and intent become complex very quickly.

What are you cryptographically signing and what constitutes modification?

Digital RAW unprocessed data as a function of taking a picture is not itself a picture yet, there is no such thing as an unprocessed picture. Are you signing this?

Resolution and sensor crop is often definable.  Are you signing this?

Processing into a picture (jpeg) includes many many in-camera adjustments:

White balance
sharpness
lens correction
contrast
gamma
saturation
red eye
special effects
…

Are you signing these?

Is a crop of a signed picture not valid? A rotation?

Is an external filter a valid picture but the equivalent digital filter is not?

In photography the amount of processing differentiates “documentary” verses “art”, but even there the line is fuzzy.

If you're willing to accept all in-camera modifications to produce the jpeg, then a straight forward signature against the JPEG including the embedded EXIF data that identifies the camera and settings could be done. This doesn't address protection of the signing key.