Can the random keys generated during handshake be guessed During the handshaking of an SSL connection, the server sends its public key, the client generates a random password, encrypts it with the pk, and sends it back, then the server decrypts it and all is well.

But, given that all (as far as I know) psuedo random number generators use the current time for the seed, given a suitable timing bias of a few minutes, could an attacker guess the random key by trying every seed in a given range?

Yes, its several billion/trillion seeds, but given that there are password hashers that can try 350 billion passwords per second, this doesn't seem to be much of an issue (i know this seems apples and oranges, but the techniques are interchangeable)

You are misinformed: normal PRNG do not use only the current time as seed. Indeed, if they would just do that, then the weakness you allude to would be glaring. In fact, it indeed glared, back in 1996: the then-leading Web browser, Netscape, was using a combination of the current time and its process ID as seed for its PRNG.

Nowadays, computers seed their internal PRNG with a lot of "hardware events" from which it is assumed that some entropy can be extracted. Current time is used, not as a source of randomness (it is not random), but as a way to measure the events. For instance, one can time (to the nanosecond, using the CPU cycle counter) the moment that any hardware interrupt occurs; since key strokes and mouse movements trigger IRQ based on the biological user of the computer, the exact times at which these appear are deemed unpredictable by adversaries.

Other sources may include, for instance, webcams: a picture from a webcam, even facing a blank wall, has a bit of thermal-induced noise which will alter the least significant bit of some pixels. Such noise is stochastic in nature, and gain defies predictability.


Why is random DH group recommended over a standard group? I know in light of logjam there have been recommendations to generate your own DH group (https://weakdh.org/sysadmin.html). It seems to me that leaving this task up to the end user is much more likely to be problematic than someone precalculating an attack against a large group (like group #14 with 2048-bits or even group #16 with 4096-bits if you are paranoid).

Further, the generation of those standard groups is obviously not maliciously created (it is based on pi expansion). However, a random group provides me no guarantee it hasn't been created with ill intent.

What gives with this common recommendation?

Standard groups: https://tools.ietf.org/html/rfc3526#page-4

Don't discourage these arguments :

A quantum computer prototype is already working and making something. Guess what?
A GPU farm is very affordable nowdays, even for a private researchers. And, yes - 10xGeForce Titan Z can make A GOOD KICK-ASS
There's no actual problem generating/calculating groups "on-site", it's a way faster nowdays

So I do agree with the article you provided as a reference.


Flash and Software based vulnerabilities Assuming an attacker does not have access to your LAN\Router etc... How could they take control of your web cam\system peripherals\other resources via a flash vulnerability. That's what I hear on the news, and I would like to be made familiar of the methods used.

I can possibly see it happening if the webserver\web master wants to attack you, as he would have your ip address and other identifying information and I guess go from there. But how would an attacker that doesn't have access to the webserver launch a lateral attack on the user's of that site? And how are flash's vulnerabilities leveraged?

BONUS:Finally, bonus question, for pentesting I hear that we have to use a sniffer like nmap to scan for vulnerabilities on particular ports\services on a host on a network. I guess those vulns are previously discovered and written down on some database on the web. But my question is: once we have a target computer, how do tools like metasploit work? does the attacking computer create a particular packet that we know the target computer will handle in a self-defeating manner?

I am new to all this, so excuse my ignorance.

It is (in my opinion) possible to spread Flash Mal easily through every possible source:

Obscure Social Media/Sharing Sites
Email Scams
Advertising Networks
Hacked websites riddled with hidden flash content

For example 18 Hours Ago (from this post) Adobe fixed a vulnerability (CVE-2015-7645)

There was a reason Steve Jobs never wanted Flash on iOS


Protecting a private key on Azure Is there a way on Azure to protect a private key so only I have the key? No one else can get the key?

I understand that this might be impossible as the code we have on Azure needs the key to validate incoming XML and sign outgoing XML and therefore that code has it. But I'm asking in the hope that there's a way to stop any individual from getting it.

I ask because I've learned over the years that occasionally someone you thought could be totally trusted, can't be.

Azure has a feature specifically for this Azure key vault
These are backed by HSMs - this is what you want. You need to assign access to the application via serviceprincipals and the usual authentication / authorisation but this is how you want to be storing keys for applications within Azure.

  "With Key Vault, Microsoft doesn’t see or extract your keys."


How to encrypt using a private key file generated by OpenSSL? When I use openssl genrsa -out yourdomain.key 2048 command to generate a key. I understand the yourdomain.key file contains both the private and public keys. But when I check the content of this key file, it starts and ends with -----BEGIN PRIVATE KEY----- and -----END PRIVATE KEY-----, which gives feeling that this file is just the private key. Why is that? This makes me very confused.

If I want to encrypt a message using private key, do I apply the entire yourdomain.key key? Or should I extract the private key part from it and use that?

Do not use the OpenSSL command line to encrypt or sign anything. The OpenSSL command line is a debugging tool. To encrypt or sign a message, use a tool designed for this purpose, such as GPG.

A private key file contains all the information needed to construct the public key. If you have a private key in a format that OpenSSL understands and you want to get the corresponding public key, you can use openssl pkey -pubout …. But that's not the format GPG needs. GPG generates its own keys.


I copied my .gnupg folder from Mac OS X, and now Seahorse lets me sign my own key. Is this normal? I have a dual-boot setup with Mac OS X Mountain Lion and Debian GNU/Linux Sid (fully up-to-date).

I installed gpg in OS X by executing brew install gpg. I then generated a keypair for myself to use.

The gnupg (and gnupg2, although this isn't the default gpg) and seahorse packages were installed during the Debian installation.

When I open Seahorse, I get a window with one item that says my name, my email, and "Personal PGP Key". When I double-click on it and get a details view that says "Private PGP Key", the key ID, my email and my name.

Here's my question: when I click the Names and Signatures tab in the key details window, it gives me one item in the list - my key. However, when I click on the key, the button to sign the key is enabled. Is this normal behavior? If it is, what would be the use for signing your own key?

If you generate a public / private PGP key pair and publish the public half without signing it with the private half you're leaving yourself susceptible to a denial of service attack. Once you push your public key to a PGP server, it can be modified by an attacker and redistributed.

The attack goes something like this: attacker gets your key from the PGP server, modifies the user ID (email) while the key fingerprint will remain unchanged so the key will still look authentic.  They then redistribute they key as widely as possible, maybe through another PGP database.

Anyone who doesn't already know your email and has to rely on the public PGP database to find it will send messages to this new ID and you'll never get the mail.  Still, the attacker won't be able to decrypt them without getting your private key so it's just a DoS and one that isn't very effective IMHO.  Very few people use PGP servers as address books these days.

Still it's a possibility and one that's well known and easily defeated.  Last I remember most PGP applications sign they public key when the pair is created by default but it's been a long time since I've created a new key.

There's a good write-up about this here: http://www.heureka.clara.net/sunrise/pgpsign.htm


Security model for datacenters I have several datacentres and now I want to plan security for it, so it's resilient to external attacks.

I need to make a security model which will cover my web servers, auth servers, log servers, routers, databases and so on running on the Internet, and at minimum it should include:

OSI layers are present
source code handling
certification
secure operating system build, network policy and sql schema
encryption

Basically, there would be security on each layer, and these layers would have to be linked and the process managing these would have to be robust.

For the Secure Development Lifecycle I have seen Microsoft's SDL - is this appropriate for that stage?

The user management and physical access is something simple to understand and follow, it's not the big deal, I have good alarm systems as well monitoring, however I do lack the above at the moment.

OK, it sounds like you are asking for a policy, plan, and practices for secure system administration of a data center.  I have some suggestions for you:

Start with a policy. Start by thinking out your security policy.  Develop a written security policy, and gain approval from management.

Take a look at SANS's resources on security policies.  They'll give you some ideas of things that might make sense for you.

Security plan. Develop a security plan.  I suggest you start by building up an inventory of the data and systems you store, with some idea of how critical it is to the mission of your business.  This will help you, because you should plan to devote the most energy to securing your most mission-critical assets.

Next, you might give a little thought to what are the most important kinds of attacks or threats that should receive the highest priority (either the most likely, given your situation, or the ones that would be most serious).  You can brainstorm what threats you are most likely to face (e.g., who will have an incentive to attack you?), and use this to help you develop a plan for securing your organization.

Once you have inventoried your assets and prioritized the top security issues you are likely to face, develop a plan to mitigate the risks and protect your organization from these attacks.  Take a look at the SANS list of top 20 security controls; they might form some elements of your plan, or might give you ideas for how you can protect your assets from these threats.

Execute. Next, implement your plan.  You don't need to do everything at once; it is fine to pick a piece of your plan, execute on it, and gradually grow your security maturity level.
Security training. It might be helpful to have some training on good security practices for system administrators.  I'm not the right person to ask, but others might have some suggestions.  I think SANS has a good reputation for professional training in this area.

Resources for additional information.  Take a look at Security policy for system administrators on this site.

You might want to take a look at the questions tagged security on ServerFault.  ServerFault is a sister site where many professional system administrators hang out, and they have some good resources on topics related to security oriented for sysadmins.

You should be aware of professional organizations in this area, and consider joining them and making use of their resources.  Look at SANS.  They have many resources available on their web page.

Also, look into LISA, a Usenix professional association for system administrators.  They have excellent conferences, good networking opportunities, and chances to keep up-to-date on the latest technology.  Also, they have a booklet series with some information for sysadmins; see, e.g., System Security: A Management Perspective.

What about Microsoft SDL? Microsoft's SDL is fantastic -- but it is really oriented at software development.  I don't think it's going to be as useful to system administrators, so it might not be quite the right resource for you.


SHA, RSA and the relation between them SHA is the hashing mechanism. However, RSA is the encryption algorithm.

So does RSA algorithm use SHA hashing mechanism to generate hashing keys which in turn is used to encrypt the message??

Moreover, RSA itself gives 2 keys. One can be kept public and one private. Now, these keys can be used to encrypt as well as decrypt. Ref : RSA. Then what is the use of SHA in RSA?

In a certificate given by any site that gives HTTPS security, there is an SHA as well as a MD5 key present. How are these produced and used in the eccryption or decryption of data transferred to the browser?

RSA is actually two algorithms, one for asymmetric encryption, and one for digital signatures (the signature algorithm is traditionally -- but incorrectly -- described as "encryption with the private key" and this is an endless source of confusion).

Asymmetric encryption uses keys. Keys are parameters to the algorithm; the algorithm itself is the same for everybody (in software terms, it is the executable file) while keys vary between users. In a key pair, the public key is the key which is used to encrypt data (convert a piece of data, i.e. a sequence of bytes, into another sequence of bytes which is unfathomable for everybody) while the private key is the key which allows one to decrypt data (i.e. reverse the encryption).

Whereas in symmetric encryption, the encryption and decryption keys are identical, but with asymmetric encryption, the encryption and decryption keys are distinct from each other (hence the name); they are mathematically linked together, but it should be unfeasible (i.e. too hard to do with a mere bunch of computers) to recover the decryption key from the encryption key. This is why the encryption key can be made public while the decryption key is kept private: revealing the public key does not reveal the private key.

What asymmetric encryption achieves is no trivial feat. The possibility to reveal the public key while not saying too much about the private key, but such that both keys work together (what is encrypted with the public key can be decrypted by the corresponding private key, but none other), requires a lot of mathematics! RSA is full of mathematics. This contrasts with symmetric encryption algorithms which are "just" ways to make a big mess of data by mixing bits together.

Asymmetric encryption is the natural tool to use when we want to allow for confidential transmissions between any two users among a big population. If you have 1000 users, and you want any of the two users to be able to exchange data with each other without allowing anybody to spy on them (including the 998 other users), then the classical solution would be to distribute keys for symmetric encryption to every pair of users. Alice and Bob would have a known, common key; Alice and Charlie would also have a shared key (not the same); and so would Bob and Charlie; and so on. Each user would need to remember his "shared key" with every other one of the 999 other users, and you would have 499500 keys in total. Adding a 1001th user would involve creating 1000 additional symmetric keys, and give one to each of the 1000 existing users. The whole key distribution soon turns into an unusable/infeasible nightmare. With asymmetric encryption though, things are much more straightforward in terms of key distribution: every user just has to remember his/her own private key; and the public keys(being public) can be distributed through some sort of broadcasting (e.g. a directory).

RSA has some operational constraints. With the most used variant (the one known as PKCS#1 v1.5), if the size of the RSA key is "1024 bits" (meaning that the central mathematical component of the key pair is a 1024-bit integer), then RSA can encrypt a message of up to 117 bytes in length, and yield an encrypted message of length 128 bytes. That limited size, and the size increase when encrypting, are unavoidable consequences of the mathematical structure of the RSA encryption process. Due to these constraints, we do not usually encrypt data directly with RSA; instead, we select a small sequence of random bytes, which we call session key. We encrypt the session key with RSA; and then we use the session key with a symmetric encryption algorithm to process the whole message. This is called hybrid encryption.

SHA is the common name for a family of cryptographic hash functions. The very first member of that family was described under the name 'SHA' but was soon deprecated after a serious weakness was found in it; a fixed version was published under the name SHA-1 (the weak version is colloquially known as SHA-0). Four new SHA-like functions were added to the family later on (SHA-224, SHA-256, SHA-384 and SHA-512: which are collectively known as 'SHA-2').

Hash functions have no key. A hash function is an executable algorithm which is pure code. There is one SHA-1 and everybody uses the same.

Hash functions "just" make a big mess of the input data, which is not meant to be unraveled. Actually, it is meant to be resilient to unraveling. Even though everybody knows all that is to be known about a hash function (there is no key, only code, and nothing of it is secret), it still turns out to be "too hard" to recompute a matching input message, given the hash function output. It is even unfeasible to find two distinct input messages which, when given to the hash function, yield the same output; there must exist such pairs of messages -- called collisions -- because a hash function output has a fixed small size, while accepted inputs can be widely larger, so there are more possible inputs than possible outputs. It is a mathematical certainty that collisions exist for every hash function, but actually finding one is another matter.

A hash function, as itself, does not do anything of immediate high value, but it is a very important building block for other algorithms. For instance, they are used with digital signatures. A digital signature "proves" conscious action of a designated signer over a piece of data; like asymmetric encryption, this involves key pairs and mathematics, and associated constraints on the signed data. A hash function h is such that signing h(m) is as good as signing m itself: since it is unfeasible to find two distinct messages which hash to the same value, approval of the hash output is good enough. The point being that the output of the hash function is small enough to be usable with the mathematics hidden in the signature algorithm, even if the message itself is big (SHA-1 can process gigabytes of data, and yield a 20-byte output).

It can be noted that some recent variants of RSA-the-encryption-algorithm (with the 'OAEP padding' from PKCS#1 v2.0) internally uses hash functions. Hash functions are good "randomizers" (the output of a hash function does not exhibit recognizable structure) and this makes them appropriate for building more elaborate cryptographic algorithms with good security features.

In SSL/TLS (HTTPS is just HTTP-within-a-SSL/TLS-tunnel), hash functions are used for several things:

as part of asymmetric encryption and/or digital signatures;
as part of HMAC to allow client and server to verify that exchanged data has not been altered in transit;
as a building brick for a Key Derivation Function, which "expands" a given session key into several symmetric keys used for symmetric encryption and integrity checks in both directions of the tunnel.

The KDF relies on the "randomizing" and non-invertibility of the hash function. In SSL/TLS up to TLS 1.1, the KDF is built over two hash functions, MD5 and SHA-1, in an attempt to make it robust even if weaknesses were later found in either MD5 or SHA-1. It turns out that weaknesses were found in both, but it did not allow any break on the KDF as used in SSL/TLS. Nevertheless, TLS 1.2 switched to another KDF which uses a single, configurable hash function, usually SHA-256, for which no weakness is currently known.


Is it wise to remove redundant self-signatures from my PGP key? I have changed expiration date of my pgp key several times. Recently I looked at it and started to worry about the mess I can see there:

$ gpg --list-sigs AAAAAAAAAAAAAAAA
pub   4096R/AAAAAAAA 2014-11-23
uid                  Foo Bar <foo@bar.com>
sig 3        AAAAAAAA 2018-03-01  Foo Bar <foo@bar.com>
sig 3        AAAAAAAA 2016-04-11  Foo Bar <foo@bar.com>
sig 3        AAAAAAAA 2016-11-11  Foo Bar <foo@bar.com>
uid                  Foo Bar (org) <foo@bar.org>
sig 3        AAAAAAAA 2017-10-12  Foo Bar <foo@bar.com>
sig 3        AAAAAAAA 2018-03-01  Foo Bar <foo@bar.com>
sig 3        AAAAAAAA 2016-04-11  Foo Bar <foo@bar.com>
sig 3        AAAAAAAA 2016-11-11  Foo Bar <foo@bar.com>
sig 3        AAAAAAAA 2014-11-23  Foo Bar <foo@bar.com>
uid                  Foo Bar (net) <foo@bar.net>
sig 3        AAAAAAAA 2018-03-01  Foo Bar <foo@bar.com>
sub   4096R/BBBBBBBB 2014-11-23 [expires: 2019-01-11]
sig          AAAAAAAA 2017-10-12  Foo Bar <foo@bar.com>

From What do these signatures of my PGP key mean? I know that the redundant signatures come from key manipulation.

I would like to remove them so my public key is small. I think I can use clean option of gpg --edit AAAAAAAAAAAAAAAA for that purpose.

However I wonder whether there are is any reason for which I should not remove the redundant self-signatures?

In fact, when importing the public key, duplicate signatures are automatically removed. Because of this, anyone who imports your public key will already have a copy without the redundant signatures. Removing them yourself just makes it so that they do not need to do it themselves.


What is the safest way to copy a file from an untrusted system? Scenario:

There are two computers running GNU/Linux, U and T.
U is untrusted and T is trusted.
A non-executable file F (which may however have been infected with malware) resides on U. (For instance, an H.264 video file in a .mov wrapper.)
It is needed to copy that file to T and to view that file on T, with minimal risk of compromising T.
The human operator has both root and physical access to U and T.
U and T can optionally be connected by LAN.
U and T both have USB sockets and SD-card slots. A USB stick and an SD card, each large enough to contain F, is available.
No proprietary software can be used.

There are various possible methods for copying the file from U to T and viewing it on T. Here are two examples:

Update ClamAV on T. Use firewall on T to disallow all incoming connections. Connect U and T via LAN. Initiate an SCP command from T to U to retrieve a copy of F. Scan F with ClamAV on T and modify F if necessary (e.g. disinfect). View F on T with most well-audited software available (e.g. in case of video files I guess this might be mplayer or VLC or suchlike).
Update ClamAV on T. Copy F from U to USB stick or SD-card and from there to T. Scan F with ClamAV on T and modify F if necessary (e.g. disinfect). View F on T with most well-audited software available.

You may be able to think of other methods.

Of the various possible methods for copying the file from U to T and viewing it on T, which has the lowest risk of compromising T, and why?

If your adversary has access to U and is able to modify that .mov file, and if you're expecting an imminent threat coming from U, then there's no safe way to copy that file and run it on T.

An active persistent threat will find/pay for zero-day exploits and craft a version of the .mov file that will exploit a vulnerability in your media player, media libraries, codecs, or operating system.

Excluding such cases, I think the best way is to:

Update all the packages on your Linux operating system.
Copy the file from U on a storage medium (USB stick).
Disable all autoplay/autorun features on T and plug the stick in T.
Use the command cp in the command line to copy that file and that file only from the USB stick to T.
Unplug the USB stick.
Run the file using your updated media player.

Using this method you minimize the risk of cross-contamination from the USB stick, and you maintain (to a large extent) an air-gap between T and U.


Are there any security problems with Google false start for TLS? Google recently announced false start in Chrome browsers which increased TLS performance by 30%
http://news.softpedia.com/news/Google-Chrome-s-SSL-False-Start-201253.shtml

I know TLS has been poked and studied by many people for years but you can still get the implementation wrong. Is anyone aware of research into any security weaknesses or possible vulnerabilities with how Google is achieving this performance gain (even if no exploit code written yet)? I am suspicious of a free lunch when it comes to security and crypto in particular.

The gist of "TLS false start" is that, at the end of a normal TLS handshake, each party sends a Finished message to the peer, and should wait from the Finished from that peer before sending application data. "False start" removes that "should wait". Each party may then send application data right away. This implies a lower latency if the party which sends the Finished first is also the one who would send applicative data first.

Note that there are two kinds of TLS handshakes, the "full" and the "abbreviated" handshakes. The latter is used to "resume" a TLS session, namely to recompute a new session key over an already exchanged master key; the abbreviated handshake uses only symmetric cryptography and requires less network exchanges. A point which is worth noting is that in a full handshake, the client sends its Finished message first, whereas in an abbreviated handshake, the server sends its Finished message first.

In the context of HTTPS and Web sites, the client (a web browser) normally initiates a single full TLS handshake. Then the client may also open a few other parallel connections, this time using abbreviated handshakes. Each connection will be used to send several HTTP requests. If a connection timeouts, the browser will open a new one using yet again an abbreviated handshake. Since HTTPS is HTTP-within-TLS and HTTP begins by a request from the client, the "false start" optimization yields any improvement only for the very first HTTP request within the very first TLS connection to the server. This is not really a free lunch, rather a free appetizer, at most.

Cryptographically speaking, what happens with false start is that the client accepts to send its data (the HTTP request) before having confirmation that it really talked to the true server: at that point, from the client point of view, the server is implicitly authenticated. The applicative data is encrypted with a session key derived from a key exchange which used the authenticated server public key (the one from the server certificate) so there is no real risk that an impersonating attacker could gain information that way, at least as long as the key exchange algorithm and symmetric encryption algorithm are secure. However, the client does not have any proof, when it sends its request, that the intended server is really aware of the connection attempt. This is harmless in the context of HTTPS. It would be bold to assume that there is no harm in it generically.


Filling the disk with random data prior to encryption? Filling the disk with random data prior to encrypting it will supposedly make it harder for the attacker to perform any cryptanalysis. Most sources seem to state this is because it will be harder for the attacker to determine what data is actually encrypted (and which is just random garbage).

However, is this strictly necessary? It can take a prohibitively long time to fill the entire disk with random data, for large disks. If the data could be attacked and decrypted with any form of attack, then how much is this extra hurdle really worth? What is the real concern and attack scenario where this sort of prevention technique is actually any useful?

Has any encrypted data ever been decrypted because the owner failed to fill the disk with random data prior to encrypting it? Or is this practice just an overly paranoid extra measure that in reality provides no real additional security?

If needed to provide any specific answer, then assume the system is GNU/Linux with LUKS, AES 256 bit, having encrypted data on a normal HDD. Two partitions: One /boot partition with no encryption only used for booting and one root partition with said encryption.

Attack scenario: The attacker obtains the computer with the power turned off. Assuming no cold boot attack or evil maid attack is possible.

There are a few reasons why this is necessary. First, as you stated, it makes cryptanalysis of the data difficult due to being unable to identify the boundary between ciphertext and background noise. This could be defeated by capturing two snapshots of the volume and identifying the locations that change, so it's hardly a concrete security measure in this sense. This issue actually brings us onto a more important one - file systems don't evenly spread their data around on the disk, and often leaves remnant data hanging around.

This is where the background randomness is important. If an attacker can identify old blocks of ciphertext, e.g. from a file whose data was recently updated, he now has access to two versions of ciphertext using the same key (and likely the same IV, too) for two different plaintexts. This can lead to certain attack scenarios becoming more feasible, e.g. differential cryptanalysis. The background randomness makes identifying latent blocks of ciphertext exceedingly difficult.

Another case where background random data is mandatory is when deniability is required, such as TrueCrypt's hidden volumes feature. If an attacker can see that the volume spans over 10GB, but the volume only shows as 4GB when mounted, he can tell that there is a 6GB hidden volume too. By making the entire disk's data completely random, the ciphertext becomes indistinguishable from that background data, making identification of the hidden volume difficult if not impossible.


Named connections all over the world I just started working for a small business and run their server. The entire thing is on macOS, and I've been monitoring my network lately due to some weird things in a few log files.

I've come across something called named which makes connections both UDP and TCP all across the world. From what I've gathered, the named service has something to do with my DNS, however, that doesn't make much sense because I don't have anybody working overseas, or trying to connect from different countries.

My question to all of you would be, is this a reason for me to be alarmed?

named - MacOS

named can be considered to be the bind service for Mac, which all comes down to being a DNS server.

DNS

A DNS server makes requests to other DNS servers on the internet if it needs to turn a domain name into an IP address, and it doesn't know about that domain name.

A solution to this is caching, which stores addresses and hostnames, so your server doesn't have to make all requests at the corresponding servers.

Connections

This means that for every domain that has to be resolved, and isn't known to the cache, a connection (TCP) will be made, or a packet will be sent and received (UDP) by another server.

Visiting a single website with all the JS frameworks and possibly (but rarely) externally hosted images, can result in multiple DNS requests.

There are a lot of programs that have to connect to a server for licensing issues, feeds, ... which also have name resolution.

Some software is known to use getHostByName() as a connection test to big sites, or their own DNS servers, because it will check internet connection and UDP is a super fast.
(For Example: Huawei's EMUI(Android) makes a DNS Request to Baidu when booting)

But it's not all good

Before panicking, consider what I wrote above, and verify your configurations to see that connections are legit. You could also use whois to check if the connections are actually towards and from legitimate DNS servers.

If they're not all good, or you keep getting high traffic outside office hours etc, consider the fact that misconfiguration of DNS servers and firewall rules can lead to UDP flood attacks and the like.

Another totally paranoid thing to consider after all above failed is that someone activated malware on your system that hides as the named service, but that is completely out of consideration before being absolutely certain about firewall and configuration.


At what point is a cryptosystem "rolling your own"? Everybody knows making your own cipher really sucks.

Everybody also knows using existing cryptosystems, such as TLS, totally doesn't suck.

But when is the line drawn? For example, would I be rolling my own if I use established algorithms, but design my own TLS-like protocol? How about if I reimplement popular protocols?

For typical apps, you should use a library like TLS. These do a lot more than a cipher like AES. TLS takes care of the block cipher mode, padding, integrity, key scheduling, and more. All these considerations have significant subtleties and gotchas.

Now, if you're writing something like TrueCrypt or PGP then you have very particular needs and a library will not meet these. In this case, you would need expert cryptographers on the team to have credibility - and you should still use standard algorithms, and as far as possible, standard usage patterns.


How to achieve seamless SSO without having the user to login again (SAML 2.0 & ADFS using OpenSSO) We need to implement seamless SSO with ADFS SAML 2.0 using OpenSSO & we plan to go with IdP initiated GET binding. The user in client network will log in to ADFS with Windows credentials once every morning. Thereon, whenever he accesses our application hosted in SaaS environment (different network/domain than that of the client), he should not be prompted for login credentials.

The SSO Profiles supported by SAML 2.0 (including IdP initiated) require the user to enter credentials (on ADFS login page) whenever the request goes to ADFS for authentication.

Is it possible to prevent ADFS prompt from authentication? If so, How can this be achieved?

Configure the ADFS login page to authenticate using windows authentication. Then the user should be automatically redirected back to the destination page without actually having to do anything.

http://blogs.technet.com/b/abizerh/archive/2013/04/11/more-information-about-sso-experience-when-authenticating-via-adfs.aspx


How to find what has been added to my hard drive Why is my hard drive being filled up when I am not installing anything?  How would I find out the cause, e.g. is it malware, a hacker, or potentially something else?

Every few days I come home to find I have lost a few gigs off my hard drive storage space, but cannot find what has been saved/installed to my hard drive.  Is there a way to see everything that has been saved to my hard drive in the last few days? I am using Windows 7 with an internal hard drive.

I have tried checking my installed programs to see if anyone has been installing new programs without my consent and there are no new installs.

I have gone through my existing programs to see what info they are saving to my hard drive and it does not account for the amount I am losing.

I have come to the conclusion that someone is using and saving information to my hard drive or a hacker has got in to my pc and using it for storage or as extra processing power and space to run a programs.

I would recommend the freeware called Recuva by Piriform, I have used this software with clients as well as in the past in organizations I have worked for in their IT Dept.

This software works to look at data on the hard drive that might be deleted

https://www.piriform.com/recuva


Is eval() in JavaScript considered self-XSS? I found eval() in the JavaScript code of a site in HackerOne.

I could not find the where the function is called, so to test the vulnerability I went to console in Chrome and wrote the method and a JavaScript alert. The alert executed.

The company states that they are not interested in self-XSS. Is eval() considered self-XSS?

Self-XSS means XSS'ing yourself by running things in console, or stored XSS in an area that only affects the user that injected the XSS. Based on your comments it sounds like you've found self-XSS, since in order to exploit it you have to enter browser console commands.

The reason that entering console commands doesn't count as a vulnerability is that every website is vulnerable to that - you don't need code in the page to use eval or anything like that in order to write a malicious payload into the console and run it.


Android update phone number, "To continue, first verify it's you" I was minding my own business, didn't change phone, password, or diet. Then on 3 November 2017 a popup asks for my google password. Is this foul play or just bad googly manners? Should I comply, ignore, or panic?

This question may be similar to the one about the en masse Google verification request last February. I thought it might be useful to ask a new question with new verbatim text from the message for search purposes.

I just received this notice on my Samsung S4 Active with Android today, identified by a wrench icon (not shown) in the status bar. It said something about updating my phone number (also not shown).

  Google

  To continue, first verify it's you

  Enter your password

Naturally, an unexpected request for password is cause for concern. When I long-push the home button I see the app identified with a googly logo.

The answer from @LieRyan seems reasonable "...don't sign in on the password prompt on the notification bar. Instead, go to one of the Google Apps or System settings and trigger the login dialog from there." But nothing I've tried has triggered a login dialog. E.g. Inbox works without a new login.

My question is, how can I determine whether this is a phishing request? I assume the logo on the app can be spoofed by some app I don't remember installing.

This looks legitimate, I've received it myself on all Google accounts. Unfortunately, without entering your password, you cannot really know more what this is about, than what the short notification text says, but likely Google wants you to provide or update your number for them to use it for different purposes on your account, including to recover when you forgot your password.

Depending on your Android version, the notification will show what app generated it, or you can see it by long holding the notification. If it is "Google Play Services", it's likely to be a legitimate notification generated by Google. Similarly, the activity the login screen is in would be hosted by the Google Play Services app as well.


The difference between Management and Configuration Policies I am trying to find out the difference between management and configuration policies. Kindly, can someone elaborate that or showing an example so that I can understand each case.

Are you asking specifically about password management and configuration?

Management is outward facing and influences user behaviour such as 'password length' or 'frequency of password change' and typically relies on governance and policy; whereas
Configuration is inward facing and influences service behaviour such as 'where passwords are kept' (such as LDAP, or flat text files) or 'what authentication service is used to authenticate' and typically relies on technical requirements and administrative choice.


Security of a Unity 2017 Cache Server I am currently running a cache server on an ubuntu machine on our local network for an upcoming game. We have several off-site members of our team who would like to make use of the cache server too.

It would be as easy as port forwarding to the static internal ip of our cache server machine, but the problem I have is that I'm uncertain if there's any major security concerns about just port forwarding to this machine and providing the external ip address of our office to our offsite members.

Could someone discover and download all of our unreleased game assets from the unity cache server? I see no form of authentication to make use of it, and no mention of security when publicly hosting a cache server either.

My question here is: what is the best way to safely expose a unity cache server box to the outside world while maintaining some degree of security. Is it reasonable to just port forward to this machine or are there known flaws with this simple strategy?

I see no form of authentication to make use of it

I think in this case you have to wrap the process yourself. stunnel is an application that allows you to wrap any TCP connection with SSL and permits mutual authentication where both the client and server are validated.

You would run stunnel to forward connections to the localhost only listening service on the Unity server. Your developers would run stunnel clients to connect to your server and provide a port on the local machine and then connect to the Unity cache on the local machine port, thus forwarding all communication over an authenticated and encrypted channel.


Do I need antivirus for this unusual installation - or just firewall? I'm donating an old Windows XP laptop to a school.  The machine will spend its golden years doing only one thing - a process that consists of just three steps:

Recording lectures and discussions with MP3 recorder software (the app is MP3myMP3).
Uploading these recordings over an unsecured wireless connection to a password-protected (https:) school web site, to make them available to students participating remotely in classes.
Sending emails to the students after each upload, announcing that the latest recording is available.  This is done thru a GMail account (accessed with Firefox) that will be used only to do this, and only on this computer.

Here's the tricky part:  The old laptop is near its performance limit when doing real-time recording, and competing with wireless connections and security software for CPU cycles sometimes puts it over the edge, and we end up with skips and blips in the recordings.  So it seems necessary to disable the wireless and disable the security services (currently using Norton Security Suite) while doing step 1, then re-enable them (in the opposite order, of course) when doing step 2.

But the problem with these disable/enable steps is that this whole process needs to be as simple as possible for the users who are doing it, because there are time constraints, some users with little training and experience, and the problem that each manual step is another opportunity to make fatal errors.

I'm pretty sure we need to have a functioning firewall during step 2, but I'm not sure if we also need antivirus, if all we'll ever be doing with this machine is these three steps - no other emailing, no web browsing, no other apps that interact with the internet.  If we can do without the antivirus, that would save the two steps of disabling and re-enabling it.

So I'd appreciate yes/no advice about antivirus, and any other ideas for improving this peculiar setup.

Given the limited scope of use, I would say no, anti-virus is not critical.  There are a couple of things I would do here to ensure that it's as secure as it can be, under the circumstances.

Make sure you have all the latest Windows Updates for XP.  (May they rest in peace.)
Ditch Norton entirely, and configure the Windows firewall to reject all inbound connections.
Uninstall everything that isn't required.  Doubly so for Adobe products and the Java runtime.
Disable every service that isn't required.  This should be a lot of them, given you have a single purpose machine.
Enable every protection available.  (ASLR and DEP are both options in XP, IIRC.)
Have them use the physical switch to disable wireless when they aren't uploading or using Gmail.
Check to ensure there are no unnecessary non-service programs running at start up.

Ultimately, some of this is bordering on paranoid mode (disabling wireless) but it's all going to improve security, is easy to implement (because you do it before you give the computer to them, they don't have to do anything other than switch wireless on and off) and getting rid of any cruft that could be running will improve performance to boot, which sounds like it's at a premium for this specific application.  I really would not be terribly concerned about the security here, given the limited application of the device, but these steps should make it as secure as it can reasonably be.


Why does not Referer header use “same-origin” by default? Same origin policy is an important part of the security model so it is "on" by default for most things, but for the referer it does not seem to be so. The default for browsers seem to be no-referrer-when-downgrade which in practice is close to "always on" I suppose as everyone uses TLS.

Probably same-origin would be a more secure choice since it won't leak your URL's to the 3d party?

So I am wondering if there is any good reason for that?

My guess it is either too important for advertising or just was historically so and no one wants to change it.

Referer is a really old HTTP request header which is much much older than the idea of a Referrer Policy. In fear of breaking things the default behavior is the traditional one, i.e. nearly always on. Keeping the old default even if it is considered bad is a theme which can be seen with many security and privacy improvements in web development, for example with Content-Security-Policy (default: allow everything, which makes XSS possible) or the Cookie flags Secure (default insecure), HttpOnly (default: can be read from JavaScript, thus making session stealing using XSS possible), SameSite (insecure default helps with CSRF) etc.


Replacing windows shell for everybody but the system administrator [cross posted from superuser - I believe the question is also relevant here]

I'm trying to harden a windows 7 machine, including replacing the default login shell from explorer.exe to a custom application.
This part works well.

However, I also want that the administrator will still be able to manage the machine, so I modified the user specific key:

HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\shell

back to explorer.exe - but when I log on I get a single windows file explorer window, and not the full desktop.

does any one know how to configure the normal desktop shell only to a specific user?

It seems like you're going about this the wrong way round, instead of mucking around with vaguely documented registry keys, I think you'd be better off just defining a proper GPO (group policy object).
I dont have an environment handy to verify this, but I assume its possible to define a custom shell according to the user's group...


role of ISP in defeating Dos DDoS What is the role or responsibility of my ISP to protect my network that is connected through their network to the Internet  against DDoS / DoS  ?

It depends on your contact with the ISP. Most ISPs just connect you to the internet and deliver any traffic addressed to you, including DoS/DDoS traffic. There are multiple ways to protect yourself against attacks, and some ISPs provide some features for you (like black holing some traffic) so you can protect yourself.

Additional DDoS protection services usually have to be bought and implemented separately, from your ISP or from a specialised DDoS protection service.


"Friend" stole SD card. Tracing an SD card? First off, let me say that I currently live in Mexico, a land filled with petty theft. I had a group of friends over last night, and they were looking at the photos on my camera. Today, I looked at my camera and saw that its SD card was formatted. But then I realized that it was formatted in FAT, and the camera doesn't even work with that file system. Nobody had access to a computer, so I think that somebody placed his SD card in my camera and took my SD card (no idea why). So now I have his SD card.

Now, I'm not entirely sure who did this, but I have an idea.

If I could some how check which cameras this SD card has been used on, I could then find out who has that camera, and voilà, I'd know who did it.

I don't know much about security, but is there a way to do this?

Update

Ok, well apparently nobody stole my card. Thanks to HamZa DzCyberDeV and TildalWave, I was able to recover every photo on the card. And it is my card. Somebody just reformatted it...

Provided you didn't reformat the new card and/or write anything else on it, there's a good chance you could restore some of the deleted contents with tools like undelete or unformat (some such tools are freely available, just Google for them). I've done it before and is quite possible, that is of course, assuming the card in question was actually used before, and is not new and never written on.

Restored files would probably be missing parts, or at the very least their names would be all wrong (FAT removes the first letter of the filename on delete), but you could perhaps be able to inspect EXIF data on any such restored files (JPeG files), or load RAW files in a compatible reader, and see the camera make from there. Another possibility is also to check for any XML files in the directory structure (usually in a folder named DCIM_XXX where XXX is some incremental number), as some camera manufacturers include thumbnail information in them (e.g. Panasonic does, possibly others too). Often (it is so on my camera), these XML files would contain camera model information. If you have problems finding good tools to read such metadata in, you could also load them in freeware software like Notepad++ and inspect for any identifying file header information (such metadata are normally in the first parts of files).

But whatever you do, don't write on the card (unless you're trying to restore previous files with undelete, or unformat it), and move the read only slider on the side of the card to locked position before putting it in other camera models, as a precaution.

The read-only lock on this photo is the orange part on the side, push the slider down (photo shows it in write enabled mode) to make it read only:

Alternatively, some partition restoration tools (mostly more advanced and as such paid ones though) are also capable of reading your card's raw data, and creating disk's mirror copy that you could upload to your forensically better versed friends to play with, and see if they're able to come up with something. Assuming the raw data stream is not filled with data, such disk's mirror image should compress pretty well with file compression tools, and you might end up with a few MB worth of data to upload - quite reasonable to expect that shouldn't be a problem then. ;)


Help! Someone fake texted or made a photo with my number calling and texting them My husband received a Facebook message from a random guy who’s profile we cannot find nor could we respond! It was this picture that I attached. He’s made a picture where it looks like my phone number is calling him and texting him, when I did not.

How can someone make this photo? Is it possible?
The text in black which I marked out is saying
“Tell your pregnant wife to leave me alone. She’s a slut and I’m not interested”

My husband says to let it go but I’m losing sleep as to why someone would want to hurt us so much and it’s affecting me.

Is it possible someone could make this photo?

so by the sounds of it you have not been hacked based on their being no log of these text messages in your phone bills. Although (not sure if its an issue on my end or yours as new users) I cannot see any images being referenced but yes! anyone with a decent knowledge of a photo editing tool can create nearly anything they want as an image.

If you're simply referring to alleged missed calls and text conversations then they don't even need to be skilled. There are Apps for most mobiles that allow you to fake a missed call, specifically marketed on the store. And a quick google found this site which makes conversation chains easy for iPhone at least and it won't be the only one out there.

I know some of these can be quite scary, usually from a security point of view they would be sent to you not your husband with the intention of trying to get money out of you, so the motives for this one are probably outside of a security scope. I agree with your Husband, if he isn't concerned you have no reason to be, since any likely motive would be to do with your relationship and it clearly hasn't worked.


Is a password easier to brute force if it contains a repeating pattern? My question is different from this previous question: Does repeating one word to form a password result in a similar pattern in its encrypted format?. I'm specifically wondering about brute force attacks. Based on my experiences with John The Ripper, I doubt that repeating a pattern in a password would shorten the time to successfully brute force a password like f00B@rf00B@rf00B@r as opposed to a random string of equal length. However, my doubt is based on the fact that, according to the documentation, JTR does not include a specific attack mode for repeating patterns. JTR, and presumably other brute force tools, can be customized for any arbitrary attack mode. But we can't know how often attackers bother to customize attacks in this way. So then the question becomes mathematical. Please forgive the awkward pseudo mathematical notation.

T = brute force cracking time

PL = pattern of characters of length L

N = number of times PL is repeated

R(LN) = string of random characters of length (L times N)

Would it be true that

T(PL*N)= T(R(LN))

If true, then a repeating pattern password would not affect brute force cracking time. But is it true?

There are three scenarios here:

Attacker has no knowledge of the pattern scheme:
When the attacker has no knowledge of the patterns, the brute-force attempt will have to be exhaustive. The attacker gains no practical efficiency improvement, because there is no way of him knowing the construction of the password.

Attacker has some or full knowledge of the pattern scheme:
If the attacker has knowledge of the patterns, they may improve the efficiency of their bruteforce attack by not attempting passwords that do not match the pattern scheme.

Attacker has no initial knowledge of the pattern scheme, and multiple hashes are available:
If the attacker has no initial knowledge of the pattern, but has a number of different password hashes to crack (all of which use the same scheme for the password) he may crack a small number of them via exhaustive bruteforce, then deduce the pattern. From there, the attack becomes much more efficient.


jquery $.post CSRF protection How can I protect the following code from CSRF?

$.post("lib/newEmployee.php",{employee_id: employee_id, employee_name: employee_name},
 function (output){
       //code
});

And here is my form (it is submitted after being validated with jquery validate):

<form id="new-employee" class="inline-input" action="#" method="post"/>

             <input type="text" class="input-block-level" id="employee_id" name="employee_id" autocomplete="off">

             <input type="text" class="input-block-level" id="employee_name" name="employee_name" autocomplete="off">

             <button type="submit" class="btn btn-success btn-block">New Employee></button>

</form>

The simplest way is to check for the X-Requested-With header being set. An alternative is to check the Origin for supported browsers.

Alternatively, check out the other solutions on the Cross-Site Request Forgery (CSRF) Prevention Cheat Sheet.

Double Submit Cookies might be appropriate here as you will not require server side state, although the Synchronizer Token Pattern is the most secure approach as the token value is generated server side.


XSS to overcome HTML entities In a search box (<input value=" *insert search term here* "...>), when I input " onmouseover="alert(1), the double quotes are converted to their entities, so it's not possible to break out of them. Is there any possible way to inject JavaScript in this case?

No.

If the user input is properly encoded (HTML encoding in this context), XSS is not possible as user input will never be treated as JS code. Proper HTML encoding (conversion of input into their HTML entities) is the preferred way of preventing XSS when any user input is inserted/reflected back within HTML code.

Your example seems to be a case of DOM based XSS (where user input is never sent to the server and is inserted into the DOM directly). If this is the case, the conversion into HTML entities (HTML encoding) is being done on the client (browser) it self.

Chances are, this input is reflected back somewhere else in the response (case of Reflected XSS). Some examples where XSS can be performed in your scenario:

As value to another HTML attribute (HTML context) where this input is not HTML encoded.
As value to an event handler or declared as a JS variable within the inline script tags and given the data is not properly encoded here.


Verification code within mobile phone applications In most phone applications with two factor authentication I noticed that the verification code is usually 6 digits long.

I wonder why 6 digits are needed - we already know that the user is associated to a specific phone number. Why can't we use 4 digits code?

Is there a problem that two different users (with two different phone numbers) will get the same generated 4 digits code? if this is a problem, obviously 6 digits code won't resolve it.

The use of six digits allows you to have one million available combinations.

While you state "Is there a problem that two different users (with two different phone numbers) will get the same generated 4 digits code? if this is a problem, obviously 6 digits code won't resolve it" - well actually, no - a six digit code gives you more available numbers and for a company with a userbase measured in hundreds of millions of users the available combinations is an important factor.

The generation of verification codes is also discussed in this Stack Overflow question: "How to generate a verification code/number?".


Retrieving malware report information from malware network I'm getting ready to stand up an isolated malware network at the place I work for performing analysis tasks and it will have a suite of reverse-engineering and analysis tools on it. For obvious reasons, this network is going to be disconnected from our normal business network. I have been trying to figure out, though - what is an appropriate way to retrieve screenshots, text, disassembly, etc. off of the malware network for when I want to present those things in reports? Is a separate computer with an antivirus scanner sufficient? I have been trying to find articles describing the sanitization process other people use but have not found any good resources.

Learn more about sandbox environments, try Cuckoo sandbox.
You can configure everything, so that it takes screenshots (which are not infected) and generate other information.


How to prevent XSS in SVG file upload? Currently assessing an application, I found out that it is possible to submit an SVG file containing JavaScript (the app is also vulnerable to XXE). I wondered if there was a method to prevent those vulnerabilities and secure the SVG submission form? How to be sure that all obfuscation methods are caught?

In first place, I developed a blacklist approach but from a security point of view, it is a very very bad approach. What do you advice me?

Take a look at this fantastic blog post that was recently published by security researcher Robin (@digininja) about this exact topic:

Direct view with content-disposition: attachment - not vulnerable - Headers are sent to force the file to be downloaded.

Direct view with CSP - not vulnerable - The Content Security Policy is set to disallow inline JavaScript.

Image Tags - not vulnerable - The SVG is referenced through image tags which prevent scripts.

Tags With CSP - not vulnerable - Image tags and the same CSP as above for double protection.


How to minimize the risk posed by Intel AMT/ME's "ring -3 exploits"? This question is about how to minimize the risk posed by Intel AMT/ME's ring -3 exploits? I'm looking for advice on common strategies and practices. Here is my current situation.

I am parking my encrypted Intel iCore5 mobile device often in S3 hibernation mode, while the laptop is plugged in. I run a GNU/Linux and I do not use wired networking but wireless LAN. The memory itself is not encrypted (e.g. a system working on the TRESOR concept).

According to my understanding of this article about Intel's AMT/ME vulnerability risk can be assumed by the mere fact that a second processor, i.e. the AMT/ME, is able to run during S3 hibernation and use network communication.

To clarify, for suggested improvements and risk/exposure reduction strategies, I do not in any way appreciate nor need that AMT/ME stuff. Is there a way to disable it? Additionally, would using Coreboot reduce this risk further? If so, why?

Also, I was thinking about making a hardware switch on the antenna of the WiFi in order to shut it off with the system. Even the idea of being vulnerable to OOB by Intel's AMT/ME "feature" while the machine is up and running is not a happy thought.

At the end of the day, there is nothing that you can do with the iCore5.
It has a permanent backdoor that has total access to and control over the rest of the PC.
If knowing this fact bothers you, then you can only really do one of two things:

Turn back now and refocus your mental energy on thinking happier thoughts.
Dig deeper and develop a newfound appreciation for the GM45 chipset and 'obsolete' ThinkPads.

The fastest and most capable PCs with removable ME are ThinkPad models X200, T400 and T500. These can be completely rid of Intel's ME in a relatively straightforward procedure that only requires a beagle bone black, an old ATX PSU, a Pomona 5252(works with either the SOIC-8 or the SOIC-16) and some jumper wires.

Alternatively, you can purchase one of the aforementioned ThinkPads with the ME removed for you, albeit at a massively increased cost.


What kind of SSL certificate do I need? I am making a web site which can be considered similar to Reddit in some ways. I need to implement a sign up form so I will store informations about the users. My idea is to store the username, password, email address, and if they want also the gender, birthday and country.
There are many SSL certificates, from free to expensive ones, in my case what are the characteristics that my certificate must have?

I am not looking to spend a lot of money and if it makes any difference in the cost of the certificate I could store only the username, password and email address.

Could a free StartSSL certificate be enough? Or what about a RapidSSL certificate 49$?

To have a secure service, you must:

Ensure that the data from your Client -> your Server is encrypted, that's where you need the SSL/TLS certificate
Ensure that the security-related data (e.g. password) on your server is stored in encrypted / hashed+salted form.

A certificate from StartSSL is as secure as a certificate from other CAs, if your client's browser does trust the CA.
The CA does not know the certificate's private key.


SafeBrowsing domain vs. url distinction Does SafeBrowsing actually work with the URL paths or does it only look at the domains? If it is just the domains, does it also look at the subdomains or are the results for example.com and x.example.com going to be the same?

The details of Google's SafeBrowsing request can be found in their API documentation, which is freely available here.

On this page, the URL expected is described as "valid URL string following the RFC 1738", or more verbosely:

The url parameter indicates the URL to look up. This must be a valid and properly encoded URL. Non-ASCII characters must be in UTF-8. For example, if the URL contains an '&', it could be interpreted as the CGI parameter separator. Therefore, all reserved characters must use percent encoding, which is defined in RFC 3986 .

Therefore SafeBrowsing works with the full URL (which does not mean that, seeing too many suspicious URL matching the same domain, it may not internally flag the domain itself as suspicious, but this is Google's internal recipe and I doubt any official public information is available on the exact algorithms they use).


Is there any way to force browse HTTP if all the traffic is redirected to HTTPS? The webserver is configured to redirect all HTTP request traffic to HTTPS. And there seems to be different application running on 80 and 443.

443 is not vulnerable but there are lot of vulnerability exists on 80.
When I am trying to browse http://example.com through browser it redirects me to https://example.com.

Now when I use nikto to scan the site at port 80 it list a lot of vulnerable links. Please suggest.

A redirect (to https, or anywhere else) is a "302" return code from the server

https://en.wikipedia.org/wiki/List_of_HTTP_status_codes

which your browser honors, and then re-requests the redirected page.

If "nikto [...scans...] the site at port 80 [and] list a lot of vulnerable links"

then the server is still returning a page.  You would need to use a modified web client which doesn't follow the "302" redirect, the way nikto apparently isn't.

That still seems odd though, as most web serves which send a redirect do not also send the original/old page.  You may want to be sure nikto isn't just showing you the contents of the page after silently following the redirect to the https site.

Finally, the software running port 80 and 443 might be the same.  A single web server can handle both http and https connections, and serve out the same or different pages in response


Claim that Skype is an unconfined application able to access all one's own personal files and system resources Situation
I was about to install Skype on a laptop driven by Ubuntu 18.04 LTS Desktop.
The software installation helper graciously informs me that Skype

is unconfined. It can access all your personal files and system resources

as per the screenshot below.

Apparently there must be reasons to make a distinction from applications that do not call for this warning.
Reality-checks

Can Skype really scan anything I have in my home directory regardless of the permissions set to files and directories? Does it become like a sort of superuser?
What is the meaning of system resources there? Does it go about functional resources like broadband and memory, or is that an understatement for control on all applications?

Mitigation

How is it possible for an average "power user" to confine such an unconfined application?

Beside the mere answering, pointing out to interesting readings is also appreciated.

Why am I getting this message?

The idea of snap is to be an "app store for Linux", with much of the same benefits as app stores for other platforms, such as iOS or Android. One of the big advantages is that applications are rather confined, unable to interact with your OS unless the user gives it specific permissions.

In snap, there are several different "confinement" settings, as documented here:

  Strict

  Used by the majority of snaps. Strictly confined snaps run in complete isolation, up to a minimal access level that’s deemed always safe. Consequently, strictly confined snaps can not access your files, network, processes or any other system resource without requesting specific access via an interface (see below).
  Classic

  Allows access to your system’s resources in much the same way traditional packages do. To safeguard against abuse, publishing a classic snap requires manual approval, and installation requires the --classic command line argument.
  Devmode

  A special mode for snap creators and developers. A devmode snap runs as a strictly confined snap with full access to system resources, and produces debug output to identify unspecified interfaces. Installation requires the --devmode command line argument. Devmode snaps cannot be released to the stable channel, do not appear in search results, and do not automatically refresh.

The Skype app is most likely a "Classic" snap, which means you don't get the same benefits as from a strict confinement.

Can Skype really do anything on my system?

Skype can do as much as any other traditional binary can do, such as those installed via apt. It does not generally become "some kind of super user", but it could use sudo or other means to ask to become a privileged process. The easiest way to do that is to simply refuse running as anything but root.

However, Skype cannot magically bypass any file permissions, unless you specifically gave the binary capabilities to do so.

What does it mean by system resources?

Think about apps on your smartphone. Applications have to ask to access your files, your contacts, your microphone, your camera, your location, etc.

Snap in its strict confinement setting does allow applications to access these, but individual applications need to request access to these interfaces. Of course, you as the user can forbid an application from accessing them. Perhaps you don't want an application to access the network because you don't want to use network-enabled features.

What the installer is telling you is that, since Skype is a "classic" snap, you cannot stop Skype from accessing all these resources (network, camera, etc.), at least not in an easy way.

How is it possible to confine such an application?

You can, if you so desire, try to create a strictly confined snap yourself. I assume that this will be a difficult-if-not-impossible task, else Microsoft had done that. Or maybe it's super easy, barely an inconvenience, and Microsoft just didn't care.

You could also create a limited user and configure your system to run the application as this user, then restrict that limited user from accessing resources such as the network, the web cam, etc.


All ports are unfiltered I'm currently studying a peneteration/hacking course. I am trying to use nmap against a target to find all the ports that are filtered.

I thought if I used an ACK-scan nmap would give me all the filtered ports. I used

nmap -sA -p- target

and the result was All the 65535 ports scanned are unfiltered. Is this even reasonable? What other scans can I use to complement my first scan?

Assuming that you've used one of the standard scan types initially (e.g. SYN or TCP scan) and you're getting back no open ports, I'd say that either the system has no open ports (the most likely real-world scenario) or there's some specific point your course is trying to teach (should be mentioned in the course materials) that would require a specific scan type to bypass some protection on the host.  If it's the later I'd try the various types of scan that nmap makes available and see which, if any, produce anomolous results.
The nmap documentation for the ACK scan type is relatively clear

This scan is different than the others discussed so far in that it
never determines open (or even open|filtered) ports. It is used to map
out firewall rulesets, determining whether they are stateful or not
and which ports are filtered. The ACK scan probe packet has only the
ACK flag set (unless you use --scanflags). When scanning unfiltered
systems, open and closed ports will both return a RST packet. Nmap
then labels them as unfiltered, meaning that they are reachable by the
ACK packet, but whether they are open or closed is undetermined. Ports
that don't respond, or send certain ICMP error messages back (type 3,
code 0, 1, 2, 3, 9, 10, or 13), are labeled filtered.

The ACK scan is just used to probe for weakesses in firewalls.  In real world tests you're not that likely to hit a non-stateful firewall, but again if this is a course, it's possible that that's a point their trying to teach.


How do I protect my Gmail account when accessing it via an Android smartphone? I have a Gmail account that I also access via an Android smartphone. The mail account could be used to reset passwords for other online accounts, so I want to tighten up the security around this account.

The two-factor authentication Google offers seems like a good idea for that, but I don't see how it could protect against someone gaining access to my phone. The phone still needs to use an application-specific password, which would allow an attacker to access my account.

What strategies exist to defend against such a scenario? The smartphone looks like an obvious weak link in this situation. How can one make it harder for someone to gain access to it to also access the Gmail account?

You could set screen locking (pattern or password) which will, IMHO, at least slow 'attacker' enough that you can notice missing phone and then remotely erase it, remove keys or whatsoever.


How do I get started using ESAPI WAF? I've been to the OWASP Enterprise Security API (Java Edition) Google Groups page and found this information missing.


Naming convention based exploits The book Web Hacking Exposed has a number of instances where the attacker would essentially use patterns in naming conventions to design attacks.

Can any one point me to any study on security/privacy exploits based on "naming conventions" ... such as file name, identifier names (may be in javascript), url parameters etc.? Would you say, in general such vulnerabilities (read exploits) are limited to web applications?

Hostnames reveal interesting information, such as potential code sinks (e.g. ldap1.internal.companyname.com would be LDAPi versus db1.internal.companyname.com, which would be SQLi). These can be extracted with the host-extract.rb tool.

Parameters reveal the same type of information, and may even speak words about the type of query. For example, I often see ASC or DESC listed as parameter names (especially on sort buttons in web apps), which would indicate an ORDER BY or GROUP BY injection type. Sometimes the parameter names are sortby, groupby, or perhaps sortorder or simply "order" or "group". These are very telling.

Additionally, some are called "limit" or "offset" which indicates the LIMIT or OFFSET part of a SQL query. A web application assessor usually assumes he or she is injecting into the WHERE clause, but it really could be in these other places.

Some parameter names give other hints, such as whether they are an integer or string.

Often, SQLi exploitation tools, such as sqlmap, Marathon, and bsqlbf-v2 will allow you to configure the attack query more specifically, and yes, knowledge of the current parameter keys and values certainly helps when testing them, especially during blind SQLi testing!

File names (via a path disclosure) are even more obvious. They can be used to discern whether or not a popular open-source (or potentially closed-source if you read a lot of code!) package or component is installed on a web server. You can usually get down to the specific version. InspathX and WhatWeb utilize these techniques -- inspathx to identify path disclosure vulnerabilities and WhatWeb, well let's just say that WhatWeb can do a lot!

Since about half of the tools that I mentioned in this answer cite tools made by current members of the YGN Ethical Hacking Group, you should check out their Research area and Lab (accessible from their main webpage).

The authors of "Hacking Exposed Web Applications, 2nd Edition" (Note that the third edition is out, where additional up-to-date information is available) are referring mostly to custom directory/file brute-forcing lists, as well as Direct Object References (i.e. OWASP T10 Forced Browsing, OWASP T10 Failure to Restrict URL Access, OWASP Insecure Direct Object References, or WASC TC Predictable Resource Location).

In other words, if you see something like http://owaspbwa/external/ you could also check for the existence of http://owaspbwa/internal/ or similar.


Which factors should I consider for devices that accept handwritten digital signatures? These days many locations ask you to give your signature on a digital signature pad/device.

As I am situated in Europe, the EU directive 1999/93/EC seems to regulate it. From what I have found out so far from a device's perspective, to comply with the directive it would have to:

have a private key embedded in the device which is signed by a trusted CA, with which the handwritten signature and document are encrypted
ensure that the private key only exists in the device and is not extractable (some companies also offer iPad solutions, so the private key probably isn't a must)
pressure sensitive capture surface, so that the signature's biometrics can be captured

But what else should one look for in the device/solution to make sure that the signatures accepted on the device are as valid as their paper counterparts (for example can hold up in court)?

  This question was featured as an Information Security Question of the Week.
  Read the Dec 19, 2014 blog entry for more details or submit your own Question of the Week.

I don't think there are going to be any guarantees.  If there is not previous case law on topic, then I would expect this to come down to an assessment of credibility, based upon the testimony of the people involved, possibly testimony from expert witnesses, and the rest of the circumstances surrounding the court case.

Keep in mind that the legal process doesn't treat signatures as absolute ironclad guarantees; they consider them as part of the totality of the evidence.

If you want to think about how to ensure this will stand up in court, I would have two suggestions.  First, talk to a lawyer.  (Legal advice is not our strength on this site.)  This is the most important advice I can give you: talk to a legal expert.

Second, I would suggest thinking about this from an adversarial perspective.  Imagine you were an expert witness hired to demolish the credibility of the signature in court.  What would you be your line of attack?  What would you say, to try to convince a judge or jury that the signature doesn't prove anything?  Then, think about what processes or mechanisms you can put in place to make those arguments less compelling.  Note that complex technical mechanisms that are hard to explain to a jury are not likely to be an effective rebuttal; you need to look for something that will be persuasive in a courtroom, which is not necessarily the same thing as what mechanism will be most effective from a technical perspective.

My guess is that, for a low-value transaction, you probably don't need any crypto.  If you've captured a signature that appears to match how Alice signs her name, that's probably going to be good enough for a low-value transaction.  Conversely, for a high-value transaction, I'm skeptical about whether these devices are going to be persuasive in court, no matter how much fancy crypto you've thrown into them.  We have decades of familiarity and experience with wet ink signatures on paper, and we understand their failure modes a lot better than we do digital signature pads.  Look at UK's chip-and-pin, for instance; it has suffered from multiple serious security flaws (found primarily by security folks at Cambridge), even though their scheme has lots of fairly reasonable crypto that was designed and intended to stop such attacks.


Can access tokens be given to a third party app's end users for a secure read/write process flow? I have a B2B web app (and API) called XYZ. I have business customer ABC (and DEF, GHK, etc.), each of which have their own web app with their own distinct users. When a new user of ABC (or DEF, etc.) registers, they also create an entry in my web app XYZ. I'd like to provide a UI form to the end users of ABC (in their respective web apps, not mine) that lets them view or edit their own custom XYZ data.

My proposed solution is:

User J of customer ABC requests to view (and later submit with changes) my UI form
Customer ABC validates user J is authenticated and authorized to view the form, how ever they choose to do that
Via server-to-server communication, customer ABC requests a single-use read token and single-use write token (with a minimum length, non-incrementing, and an expiration date) for that user
I validate the request (using a shared secret between ABC and XYZ perhaps), and send back the two access tokens
The form uses the read token to request the data from my XYZ server, and is marked as used
If user J does a POST with the form, they use the write token

Everything is done over TLS. Is this a valid, secure approach (in theory)? Is there a better way (using third-party cookies perhaps)?

I am unsure whether the end-user posts the form directly to XYZ, or if it goes through ABC to XYZ. Assuming the former, I've thought of a method which borrows some ideas from the OpenID Connect protocol.

Suppose ABC provides the end-user with a JWT upon authenticating, which will contain the following claims:

"iss": "ABC"    # ABC issued this JWT
"sub": "user_j" # The end-user's unique ID
"aud": "XYZ"    # The intended audience of this JWT
"exp": "..."    # The expiry time
"iat": "..."    # The time the JWT was issued
"scope": "form.read form.write" # Permissions

When the end-user requests the form from XYZ it sends the JWT. The JWT contains a signature signed by ABC, which will allows XYZ to verify it's authenticity. XYZ can also check the expiry time and the list of permissions. The same JWT can be used when submitting the form.

The advantages of this method are that it reduces one round-trip by not having to specially request tokens from XYZ, and that you don't need separate access tokens for each permission, which is important if you want to introduce more permissions in future.


How to prove iOS app is vulnerable to MiTM I'm updating an iOS app and I want to prove that it is vulnerable to MiTM attack.

I have set up Charles Proxy on my mac and configured the Simulator so that it trusts Charles CA Certificate, per these instructions: http://www.charlesproxy.com/documentation/faqs/ssl-connections-from-within-iphone-applications/

I am able to run the app and now I see the HTTPS traffic in Charles, in clear text. OK, Good.

Is this enough to show MiTM vulnerability?

I was thinking that to really prove it, I would need to set up a sniffer, etc. on a server on the network. But maybe this is too much work. Charles is a proxy, so is showing unencrypted traffic in Charles good enough?

SSL is used to prevent MiTM by assuring Confidentiality, Integrity and Authentication. SSL is based on trust. There are trusted root certificates which sign other certificates (which the user can verify) to proof their identity. If a root certificate gets compromised, then all certificates signed by this and transitively signed certificates are to be treated as compromised. The trust chains are hard coded within your applications or your operating system. Some applications are just configured to trust all certificates the operating system trusts.

If you add a certificate authority, then you are essentially saying to your device that the certificate is to be trusted. In your proxy you then use  it to perform the MiTM with the certificate you compromised yourself. So you haven't proven anything, you just breached your own trust chain and removed the one layer protecting you from a MiTM.

Setting up a sniffer will normally just show you encrypted SSL traffic.

Some applications, especially on more sensitive mobile devices, can perform certificate pinning. This means that the application does not trust the Operating System's certificates, but ony trusts those certificates which were hard coded within the app.


HTTP status code for successful login I have a web application for testing.
It has a login page.

For unsuccessful login attempts, the developers have made a custom error page so that the response from the web application shows 200 OK, but not signed in.
This is ok.

Now the problem is when a successful login happens, they are redirecting the user with a 302 redirect to the dashboard.

Is this normal? I believe a 2xx status code is the best for a successful login.

Is my assumption right?

Is there any security issue related to this?

Redirection the user after a successful login is common in the most webapps.
For instance when the user try to access the dashboard directly within its url, the system keeps the requested url and brings the user to the login page, after user signed in he is redirected to the dashboard not the homepage or something.


Storing Seed for TOTP We have a public website for employees which has access to some sensitive company information. To make the login process more secure we want to implement TOTP. The setup and implementation has been quite straight forward. What I'm not clear on is the best way to store the seed for each user.

It obviously can't be salted and hashed as you need it to generate the time based code. MD5 type encryption seems a bit pointless given how quickly it can be decrypted, so my question is what is the best way to store the seed, and is it ok to store it in the same table as the username and password?

MD5 type encryption seems a bit pointless given how quickly it can be decrypted,

Don't get your terminology mixed up. MD5 is a hash algorithm, not an encryption algorithm. There is a world of a difference between the two.

To answer your question, I don't see an issue with storing the seed unencrypted together with the username and password in a database. A TOTP seed is easy enough to reset if you ever get compromised. You need the seed in cleartext for the algorithm to work anyway.


In a company is it good to have a back door account? Having a backdoor account (that is a username/password that can login in to an administrative account on all machines) can be very useful for IT staff. However, some believe it's a security breach. What are the pros and cons?

Pros

access even if user forgets password
access whenever is convenient, for example if user of machine is away on vacation
another reason I just discovered is because if the user is non-technical they may misunderstand which password you are requesting, for example if they are running virtual machines.

Cons

may not be feasible when there is confidential information on the machine
A manager once told us that the company didn't have a backdoor account so that if something went wrong the finger could definitively be pointed at the end user

The last point doesn't really make sense to me. Most people would quickly hand over their login information to an IT staff. Even if they choose to type in the password themself, it's unlikely they will stand there the whole time and wait until the IT staff logs out. Furthermore if an IT staff is malicious then it's unlikely not having a password of a end users machine will stop him.

First of all, I would not call that a backdoor. A backdoor usually refers to methods of bypassing normal authentication, which would not include an Administrator account owned by IT. Nearly all corporations I have worked with have the IT department own the Administrator accounts and functions for all workstations and servers in the environment, whereas the end users just have unprivileged "normal" user accounts. There are a number of reasons for this:

This prevents end users from installing unauthorized applications on company owned devices.
Administrative functions, such as patching, can be centrally managed and ensured that they are applied in a timely manner.
When an IT services employee has to work on a device, they do not need the end user to be there.
Very Important: End users should be trained to NEVER give out their passwords, even to IT employees. It sounds like where you work, this is common. Above all, I would recommend an awareness campaign informing your employees to never give out their passwords to anyone, and make doing so against your corporate policy. This behavior completely invalidates your second bullet under your con section, and an employee can claim they gave their password to an IT person if anything "went wrong". Additionally, social engineering is the #1 way an outsider is going to get into your network... frankly, just flat out asking people for their passwords is quite effective in an environment like yours, even as a non-employee.

Eventually, you may want to look into an Identity Access Management (IAM) solution. If you purchase the right tool, the IAM solution manages all the administrator password in the environment, and each device has a different randomly generated password set. Any IT person that needs to work on a device must first log into the IAM solution with their credentials, "check out" the administrator password, and when done, "check it in". Once checked in, the solution will connect and change the admin password on that device, so only it knows the current password. If anything "wrong" occurs, you know the capabilities of the non-admin end user, and you can check the logs of the IAM system to see who had the admin password checked out for a particular device at the time to determine who caused the problem.

EDIT 7/27: Just to explain more regarding your below comment - small companies, such as a grocery store with 1 computer, generally have no data worth protecting (assuming credit card data isn't running through the PC), and so there is little reason to enforce an unprivileged user. Plus, grocery stores usually don't have dedicated IT folks supporting the single PC.

Large corporations, on the other hand, have significant amounts of data worth protecting. Forcing all users to run as an unprivileged user is a security measure to protect the company. Users are not security experts - they tend to download random software off the internet and install it. Often, this software has been backdoored by malware. Developers are famous for doing this, as they often like to "test" new tools. At best, this leads to an increased attack surface, at worst, the whole company's domain has been compromised.

Why do you believe developers need to be administrators to develop code? Speaking as a past developer, that is completely untrue. There is no reason to be a local admin to test/qa code. There should be a defined deployment process so that once a developer is done packaging an application, it can go through the corporate deployment/patching/update process to get pushed to the PCs that need it (initially, the qa testers). After the code makes it through testing, and is approved, it goes through the same process to be pushed to the rest of the company that needs the software installed to fulfill their job function.

That said, I am speaking about a more mature IT organization. It takes years to get there if you are starting from where it sounds like you are. Start small. End user/non-IT employees don't need to be administrators. Limit it to just IT initially. Develop your processes and procedures. Take a software inventory to determine what software is critical to the business. Eliminate everything non-necessary. Everything necessary becomes the "approved software" list. Anything not on that list, you will need an approval process to get put on that list. Continue making small, incremental changes, until you end up with a mature, and secure, IT organization.

Don't take my word for it:

Here is a nice, short article from Microsoft explaining why it's important
Limiting the use of administrator is in the SANS Top 20 security controls list
Here's another blog post on the topic
And a news article giving a good reason for doing this, titled "90 percent of Windows 7 flaws fixed by removing admin rights"


What dangers are there in storing my private key on different servers? This question is specifically concerned with storing keys in the cloud, and is somewhat applicable.

But I've got a laptop and a desktop computer at home - I'm the admin on both of those systems, and of course have my .ssh directory/contents read/writable by only me.

I also have another server @ my dad's house, where I'm an admin. And a few of my friends also have servers where I have accounts.

The obvious concern (as I've looked around questions here) is that if either my friend or his box was compromised, then the attacker would have my key. Obviously they can now try to brute force/dictionary attack my private key.

Obviously I want to be able to access these systems without having to provide a password, and frequently I make HostA -> HostB -> HostC type connections. Should I be generating a new private key for each of these hosts? Or at least the hosts that are not directly under my control?

Add the ForwardAgent option to your SSH configuration.

$ echo "ForwardAgent yes" >> ~/.ssh/config

This enables you to use authentication credentials from your public/private keypair without actually storing them on the other machines. SSH will "just work".

The one downside to this approach is that if there is an attacker on one of those machines who can bypass file permissions (e.g., as root), he can potentially authenticate to other machines using your private key (however, he cannot actually get the contents of your private key). Of course, this is still better than having stored your keys on the server, but it's worth knowing about if you expect the machine will be broken into (e.g., a honeypot).


What are the potential vulnerabilities in a SAML-based SSO approach? What level of access would an attacker need to obtain to compromise a SAML-based SSO system?

Would stealing the private key used to sign SAML requests be enough? What if an attacker had root on the server that was generating the SAML requests? Could they then later replicate sending the requests on their own machine, or do identity providers have more tricks up their sleeves?

I'm trying to weigh the pros and cons of various SSO approaches.

Thanks!

The scenarios you mention would all be a problem with SAML and would be with just about any SSO method. If someone has root access on a server or has acquired the private keys, the security of the system is significantly if not completely compromised.

When you are delegating authentication, any compromise in trust can invalidate part or all of the assurance process. If a private key has been compromised, no assertion made by the idP can be trusted.

That said, if an attacker gains root privilege on a server, you probably have much bigger problems to deal with anyway. In the case of the RSA SecurID compromise, a number of people have tried to minimize the impact and are saying it will not kill SecurID. However, these people are overlooking that the fact that these hackers had such extensive access to do what they did would make it difficult for RSA to prove that we can trust their authentication products.


In which settings is it possible to launch a HTTP Response Splitting Attack but not completely replace the HTTP message? I wondered in which settings is it possible to launch a HTTP Response Splitting Attack but not completely replace the HTTP message?
The examples I saw all allowed full replacement of the HTTP response, which made me think the attacker could have just replaced the full HTTP response in the first place.
I considered that there might be setups, where multiple components had control over parts of the HTTP message, e.g. one application would only be able to access headers. Or that some server might only be able to redirect HTTP-traffic (URL-redirect exploiting the GET-parameter which later on translates into a header field), but not read-write the body's contents.
However, I am missing a realistic scenario as an example.
Can you explain me when HTTP response splitting is successful, but a full HTTP response-replacement not?

Let's see what are the usages of Splitting attacks.
But first thing to remember is that the final target is not the attacker, but HTTP agents between the attacker and the backend having the splitting issue. And one other detail, all this works using HTTP Pipelining (where you can send several requests without waiting for individual responses).
One of the first usage is security filter bypass. You send 2 requests, but the splitting occurs on the first one and the backend respond with 3 responses. The second one is the new one, it's based on a query that the first did not saw (let's say the  ssl terminator or a reverse proxy cache, or any http load balancer). or this agent there were request 1 and request 2, and when receiving back 3 responses it will usually discard the 3rd response. Then content of response 2 comes from a hidden request (like a request which was hidden in the 1st request body, and only 'discovered' by the backend -- because there's an HTTP splitting issue exploited on this backend).
The very fact that this request was hidden prevents the first agent from applying any security rule on this request (let's say this Load balancer should prevent access to /admin/* urls, now you can hide the /admin/ request and use splitting to get the /admin response on an innocent /foo query).
Attacker        Reverse Proxy cache         Backend
  |                  |                        |
 req1[reqA]------->req1[reqA]--------------->req1,
 ,req2               |                       reqA, <-- splitting issue
  |                 req2-------------------->req2
  |                  |                        |
  |                  |<---req1, respA, resp2--+
  |<--- req1, respA--+                        |

Next usages is Cache poisoning (instead of asking /admin in the hidden request you ask for /script.js and you set the 2nd request url to /, now / content will be replaced by the script content instead of the home page in the Reverse Proxy Cache).
Third classical usage is quite hard to implement, but it works with incomplete responses or incomplete queries. With responses or queries from other users completing the incomplete responses or requests. That's usually more a thing with request splitting than response splitting. But the main idea is to get a request or response with elements coming from other users (in the case of request you could get the cookie or bearer tokens of other users added to your headers, in case of response this is more about the page content). You can get more detail on this type of attacks on all HTTP smuggling papers.
I can think of another bad usage, the complete mix-up of all requests and responses. On my first example I've been nice saying that the 3rd response was discarded. Some bad HTTP agents could also become completely crazy when the counter of requests and responses are bad. And they could start sending wrong responses to everyone.