Certification Authority Naming I'm reading the following article from Microsoft's TechNet: Certification Authority Naming

Can someone please help to clarify the following:

  In Active Directory Domain Services (AD DS), the name that you specify when you configure a server as a CA becomes the common name of the CA, and this name is reflected in every certificate that the CA issues. For this reason, it is important that you do not use the fully qualified domain name for the common name of the CA. This way, malicious users who obtain a copy of a certificate cannot identify and use the fully qualified domain name of the CA to create a potential security vulnerability.

Why does certification authority (CA) name should never be the same as the server's computer name (NetBIOS or DNS / hostname) and what are the risks?

Default common name naming scheme in ADCS is <DomainName>-<CAHostName>-CA. For very small and purely internal scenarios would work, however this scheme exposes at least two properties: internal Active Directory domain name and host name. Moreover, if CA sits on a domain controller, it may reveal the domain controller name. For example, Contoso-DC1-CA would tell that internal domain name is Contoso, CA host name is DC1. Thus we can guess that this server also acts as a domain controller. In some terms, this would be a great start for an attacker in internal structure learning.

In addition, default Distinguished Name suffix contains full X.500 path to a domain where CA resides. For example, DC=HQ, DC=Int, DC=Contoso, DC=com. Here we can identify, that company Contoso has at least three AD domains in the LDAP tree: top domain is Contoso (most likely, organization name), child domain is Int (presumably, Internal) and subchild is HQ (presumably, Headquarters)

However, security risks are not that dangerous, because in many cases it is easier to retrieve this (and much more) information in other ways. For example, investigating client certificates, use social engineering tools and so on. Naming recommendations play huge role in flexibility. When CA is sticked to a particular domain and host name, it would be very hard to move CA somewhere else (due to reorganizations) and CA name information would be misleading for corporate users. Eventually, you will have to decommission CA server and move clients to a new CA on a new place.

As a result, it is recommended to build your CAs as they are not tied to any specific domain. Though, organization information shall be included.

Suppose, you are implementing 2-tier ADCS in Contoso Pharmaceuticals and planning to deploy it in the hq.int.contoso.com and west.int.contoso.com domains, then you could use the following names for offline root CA and online issuing CAs:

Root CA common name:
    CN=Contoso Pharmaceuticals Root CA
    OU=Security Division
    O=Constoso Pharmaceuticals Ltd.
    L=Philadelphia
    S=PA
    C=US
Issuing CA (headquarters) common name:
    CN=Contoso Pharmaceuticals Class 3 Client CA
    OU=Security Division
    O=Constoso Pharmaceuticals Ltd.
    L=Philadelphia
    S=PA
    C=US
Issuing CA (west branch) common name:
    CN=Contoso Pharmaceuticals West Coast Class 2 Client CA
    OU=Security Division
    O=Constoso Pharmaceuticals Ltd.
    L=San Francisco
    S=CA
    C=US

This scheme does not reveal internal names and is not tied to any Active Directory domain, in result, it will be easy to perform CA server migration across domains and trees and even forests during reorganizations. On the other hand, they provide enough information to identify the organization who owns these CAs and may provide users some clues about CA location to select the nearest CA. Location addresses are not necessary (because they can be retrieved from public sources), but might be required by laws. At a minimum, Organizational Unit, Organization and Country RDN attributes must be specified in the DN suffix.

ADCS naming is important, but many administrators forget about another thing where naming is important: Authority Information Access and CRL Distribution Points certificate extensions. Default naming scheme reveals much more information (to a potential attacker) than default CA name. And it is hard to migrate CA somewhere else with default CDP and AIA locations. Some time ago I wrote a guide that uses best practices on CDP/AIA URL naming schemes. This might be helpful for you as well: Designing CRL Distribution Points and Authority Information Access locations


What security mechanisms enable a user to change their password under a Kerberos environment? During client authentication, neither the secret key nor the password is sent to the KDC.  If a user changes their password on the client, how is the password updated in the password database in the KDC?

According to the specifications, when the user changes passwords, the password is sent, encrypted by authenticator subkey (from the prior authentication), to the server.  The server then checks that it is valid and updates the user's information with the new password.


Is https safe enough as of now? Because of my job I keep traveling around Europe, which means I keep connecting to all kinds of public wireless.
In principle I could use a VPN and that should be always safe (is this statement right? This is my current approach)

But I also know (superficial google/wiki knowledge) about how https and mitm attacks work. My understanding is that as long as I'm browsing on https (ie, never going from http to https so I can't be attacked with something like sslstrip) and I don't accept/install any certificates when connected to these public networks, I should be fine. Is this right? Is https safe enough nowadays?

Is there anything else other than certificates and being always under https I should be caring about?

There are plenty of places that have Wi-Fi systems riddled with problems and if you are using them a lot, I would say - NO that's not enough by a long way.

My reasoning is that HTTPS is hard to get right and relatively easy to break. In addition, you are still leaking a fair bit of information when browsing over HTTPS.

Apart from the usual protections (anti-virus, etc). Running the latest OS fully patched. Using full disk encryption. That is the starting point. BTW, if using Windows, do yourself a favour and make sure it is W10 latest version.

Next up is hardening your browser. Firstly get a great ad-blocker - too many drive-by attacks now come via rogue adverts.

But the thing you should most invest in is a VPN solution. This is really the only realistic way to retain a good level of security when travelling a lot. Run your own or buy a decent 3rd party solution but that's the need.

If you are travelling to certain locations and have high-value data on your PC, even that may not be enough. In those locations you need a hardened VPN solution that kicks in before login. You should also ensure that you never walk away from your PC with it left in standby or on the login screen.

Oh, one other thing. Check local laws before you go. I think everywhere in Europe is OK but in some other countries, it might be illegal to use some of that technology. Also be careful if you take the same laptop from Europe to the USA. US Border staff are notorious for demanding access to laptops and that could put you at odds with the EU data protection laws. Better in those cases to empty all data from the laptop (with a secure delete program) and then securely download it (via VPN of course) when in-country.

Enjoy your travels!


Are random URLs a safe way to protect profile photos? I would like to move from sequential to random user IDs, so I can host profile photos publicly, i.e. example.com/profilepics/asdf-1234-zxcv-7890.jpg.

How long must user IDs be to keep anyone from finding any user photos for which they have not been given the link?

Does 16 lowercase letters and zero through nine provide a reasonable complexity? I'm basing this on 3616 = 8x1024, conservatively estimate 10 billion user accounts reduces the space to 8x1014. At 1000 guesses/second, it would take 25 000 years to find an account. Unless I'm overlooking something.

It depends entirely on what you mean by "safe".

If your only concern is an attacker guessing URLs, then 16 alphanumerics gives roughly 8,000,000,000,000,000,000,000,000 possible addresses, which is plenty to stop random guessing -- in order for an attacker to have a 50% chance of finding even one picture on a site with a thousand users in a year, they'd need to make 100 trillion tries per second, enough traffic to bring down even something like Amazon or Google.

But there are other ways for URLs to leak: people putting them in emails or blog posts, web crawlers finding pages you didn't secure adequately, and so on.  If you really need to protect something, you need to put it behind the same sort of security as the rest of your website.

Personally, for making hard-to-guess URLs, I'd use GUIDs/UUIDs.  The search space is absurdly huge, you don't need to coordinate generation between multiple servers, and most languages have standard routines for handling them.


Does a binary executable have to have some critical plain-text components? When companies package binary executables, they are often encrypted, compressed, scrambled, and otherwise made so that your lazy hacker can't simply open the program up in Notepad++ and see the code.

In all the ones I've looked at, however, they each have some critical code components which are unencrypted, uncompressed, and human-readable.  Here it seems the methodology is more "security by obfuscation" by creating nonsensical variable names and attempting to make the code as difficult to make sense of possible.  But the fact remains that it's there in plain text to be deciphered.

Is this by necessity?  I was thinking that it might have to be this way so that the OS has something sensible to execute (which then has instructions to further decompress/unencrypt the rest of the executable), but I don't know enough about it to be sure.  Or is there some way to actually scramble an entire executable without having any human-readable components?

Ultimately, the CPU runs the code. And the CPU expects instructions in "clear text". You could envision some application code where a small initial part of the executable first decrypts the rest of the code, but this has several issues:

This forces all the code to go to RAM instead of staying on disk and be loaded on-demand, implying a higher RAM consumption and longer start times.
That "decryption" routine must, necessarily, not be encrypted.
The decryption routine knows everything needed to decrypt the rest of the code, so it can be decompiled and emulated by the attacker; it is not really "decryption" since there is no key (or, equivalently, the key is embedded in the routine, which the attacker has under his hands).

Experimentally, this kind of encryption does not hinder attackers much, so the general wisdom is that it is "not worth the effort". Unless you are in a very specific scenario where the "attacker" is a mindless automaton which may be fooled by these hide-and-seek methods -- that's the case of virus, where the "attacker" is the antivirus software.

Really encrypted code is possible if the CPU is doing the decryption itself, internally, with some key management. That's what happens in a PS3 console, for instance.


How can I back up my iPhone without compromising my 2FA and master keys? I've noticed that when I restore my old iPhone's backup to a new iPhone, 1Password's master-key (which is never supposed to leave the device 1Password is installed on, and you transfer manually), my TOTP credentials (in Google Authenticator or a similar app), the Steam authenticator-key, etc … still seem to exist on the new, restored, device.

This implies that they're also sitting around in my backups — and possibly in iCloud?

How can I back up my device without compromising the uniqueness of my second factor of authentication?

Yes, from your description it sounds like 1password does not use the most paranoid key storage (class) on iOS (for the master secret). A good overview of different modes can be found in the iOS Security Guide.

You have been looking for more security, that depends on the software vendor. If you want to ensure portability of the OTP secrets I typically use the manual (text vs. QR Code) secret import step and copy the text secrets to another offline store location (password safe) before sealing them (more or less reliable) into a mobile soft token. This totally depends on my ability to responsible protect those secrets, so it might not be the way to approach that for everybody. Giving those secrets to 1password might be however even more risky than having a offline backup.

But back to your question, the app has to declare sensitive information in the right way to keep it secure (or out of the backup), there is nothing much you can do yourself. (Setting a Backup password in iTunes and turning off iCloud Synchronisation is all you could change).


How to create email that will fool DKIM verifier? Sammy the sender is sending email to Rita the recipient.  I know Sammy will apply a DKIM signature to the email and Rita is going to check the DKIM signature with a DKIM validator.  I am a malicious man-in-the-middle.  I want to modify the email so that the header values that are displayed in Rita's mail client differ from what was DKIM signed, but I still want the email Rita receives to appear to be DKIM-verified when passed through a DKIM validator.  Can this be done?  How much can an attacker modify?

So far I have learned of three techniques to do this:

Add new header. Add a header that wasn't present in the original email and isn't included in the DKIM signature.  That header will likely still be displayed by Rita's email client even though it's not included in the DKIM signature.
Multiple copies of header. Add multiple versions of the same header, with a different value.  DKIM will only check the last one; if the email client displays the first one, then a successful attack becomes possible.  To be more specific, place a malicious header -- say, a From: header with a malicious value -- before the DKIM header.  If I understand correctly, the DKIM signature only covers headers after the DKIM header, so the signature will appear to be valid despite the fact that the malicious header value wasn't signed.  Credit: Thanks to Robert Graham for pointing out this trick.
Add content after signed section. RFC 6376 points out a more obscure attack, if the DKIM header in the original email uses a l= tag (most ordinary emails usually don't) and uses it incautiously.  Probably not relevant in most situations.

Each one of these has limitations on what the attacker can achieve.  Are there any other attacks I've overlooked?

First, nice question. I've checked how Thunderbird behaves by modifying an existing mail and it actually takes the first headers for display of From, To and Subject while the DKIM signature mechanism starts from the end :( . Thus the DKIM signature is considered valid even though From, To and Subject are spoofed. Interestingly the first From line is only used in the mail view while in the list view of all mails it shows the last From line.
As for other attacks or how the attacks you've described can be used in in a way you might not have realized:

There are some mail headers which have interesting side effects and often these headers are not fully protected (i.e. protected against change or against adding a new header). Notably Content-Type and Content-Transfer-Encoding have special meaning on how the content gets interpreted. Manipulating these headers can have interesting effects. For example having a Content-Type multipart with a non-existing boundary causes Thunderbird to no longer show the original text of the mail but instead a blank content. When combined with spoofing the Subject ("download update from hxxp://...") and/or the Reply-To this unexpected blank content can be used for a social attack. Example:

 Subject: Blank mail? Download hotfix for your mail client at http://....
 Content-type: multipart/mixed; boundary=boundary_does_not_exist
 Subject: original subject
 Content-type: original/type

Similar changing Content-Transfer-Encoding to base64 for non-multipart content can cause it to display only gibberish which can be similar used in a social attack. Example:

 Subject: Mail corrupt? Download hotfix for your mail client at http://....
 Content-Transfer-Encoding: base64
 Subject: original subject
 Content-type: text/plain

If the DKIM signature uses l= to limit how many lines are used in the body hash one can also "replace" the content of mail by changing (or adding) the Content-type to some multipart type with a special boundary. The boundary is then designed to skip over the existing content included in the hash which will be treated as the preamble for the new MIME parts (and thus will not be shown). Example:

 Content-type: multipart/mixed; boundary=my_own_boundary
 DKIM-Signature: ... bh=...; l=...
 Content-type: original/type

 here is the original content, no matter if single part or multipart
 this is the last line included in the body hash

 --my_own_boundary
 Content-type: text/plain

 Only this text is shown at the recipient
 --my_own_boundary--

  ... uses a l= tag (most ordinary emails usually don't)

Actually I was surprised how many DKIM signatures with l= I've found in my mailbox. Notably mails from cisco.com use(d?) this feature and I've used one to successfully replace the content in the way I described while keeping the signature valid.

Apart from modifying an existing mail from Sammy the attacker might also be able to create a new mail to Rita which looks like it came from Sammy. This can be done by creating a mail with a valid DKIM signature and then add a faked From header on top. If Rita just checks if the DKIM signature is valid she will not see any problems. If she additionally checks if the signature domain matches the senders domain the result depends on which From header is used for this validation. But if Sammy uses one of the public mail providers the attacker could simply get also a mail account there and then it would not matter which From is considered when checking the domain because both are from the same domain.

EDIT:
The question here resulted in some larger research in 2017 where I've showed how mails can be modified without breaking the DKIM signature in real-life. See Breaking DKIM - on Purpose and by Chance.


Is 'account-security-noreply@accountprotection.microsoft.com' a legitimate sender of security alerts? I have been getting emails from "account-security-noreply@accountprotection.microsoft.com" (as verified in metadata) about unusual activity.  The internet has very conflicting information about if these emails are legitimate or not. Microsoft's own website says this is their legitimate sender address for account activity alerts.

  A legitimate email message should originate from the Microsoft account team at account-security-noreply@accountprotection.microsoft.com.

But here, the Georgia College help desk lists this exact email, from that exact sender address, as a phishing attempt.

  Many people at GC are receiving one of the more popular phishing scam emails. It appears to be from Microsoft, a “Security Alert”
  wanting you to revalidate your account. Know that this is not from
  Microsoft. It’s a very elaborate phish. Do not click on any link in
  this email. Please delete it. If you did click on the email, please
  reset you Unify password (and subsequent email password) at
  password.gcsu.edu.

  From: Microsoft account team
  account-security-noreply@accountprotection.microsoft.com

  Sent: Monday, April 3, 2017  3:36 AM

  Subject: Microsoft account security alert

Other places online have similarly conflicting info. Some places list these emails as scams, but the example screenshot has a different sender address that is missing the "microsoft.com" from the domain, which looks more fake.

So which is it? Are those emails from exactly "account-security-noreply@accountprotection.microsoft.com" fake, or not?

You can not trust that a sender address is correct. They are trivially easy to fake.

The SMTP (email) protocol allows the creator of an email to state any sender address they want. There is no validation that the sender actually controls that address. And even if the receiving mailserver does some form of sender validation, like checking if the IP address of the sender matches the domain they claim to be from, there are also some quirks in the UI of many email readers which can be exploited to display a (fake) email address as the name of the sender.

When you receive some email which claims that you need to do something on some account on some website, and this appears to be plausible (you actually have an account on that site), then take a good look at the URL the link leads to. The domain name says who controls that link. The domain name is the thing which comes before the first slash.

These URLs all lead to Microsoft:

https://microsoft.com/account
https://account.microsoft.com/account
https://account.microsoft.com/account?someTrackingId=689392356034706528902345

The following URLs are examples which do not lead to Microsoft. They all lead to a domains which might be controlled by someone else:

https://microsoft.com.example.com/account
https://example.com/microsoft.com/account
https://example.com/?https://account.microsoft.com/account
https://example.com/#https://account.microsoft.com/account
https://totallylegitaccountportaljusttrustme-microsoft.com/account
https://microsoft.com:microsoft.com@example.com

The last one is an example of a rarely used URL format which includes an username and a password (which are in this case both microsoft.com). The actual URL being requested is after the @ symbol.

If you decided that the link is probably fine, you click on it and get lead to a login form which looks trustworthy at first glance and did apparently not yet install any malware using drive-by download, then you should also check if the site is loaded over HTTPS (any reputable site will use https-only on their login form) and check if the certificate is actually signed for the company the site claims to be.

Some guides for detecting phishing attempts say that you should look for signs like broken images or non-functional links. I consider this bad advise, because it is based on the prejudice that all phishers are shoddy webmasters. The scene got a lot more professional in the past years. You should focus your attention on those things they can not fake with sufficient effort.


is this code valid for securing passwords? i was wondering if this is a secure method for a hashing password.if it is not secure please tell me what to do in order to make it secure

$pass='test'//the password
$salt=openssl_random_pseudo_bytes(225);//generate salt
$pre_hash_pass=hash('sha512',$pass);//pre hash the password
$final_pass=hash('sha512',$pre_hash_pass.$salt);//THE FINAL PASSWORD

the result(cropped for it being too long ).the full RESULT(ON GOOGLE DOCS)

=m]ˆÂýÇâ&-Ù©Þ}§˜ü=l|‹|oÓÌ×±[ý’p'lJÛ|›¦nXÝxÜ†9óÔ¢¤ÿ‰"µ^¾õJ JI^íó,•±†û½L›T0*Stÿ#s´Ë§ÔMgå.£J§èeRzù/‡üœ¿ª¡ Ç¹áuT¯ '0¯ÄŒÐ²A@ü •uuYRpýš™ü5%P—í¬ïr‚×ODÜ—´“„?”öÛž;Bí#Þcõ&¾qLEâ« |Z¯ÔÐö%R•9âÇ¸—•êäxZ³ÎÉ¶ÉêS\™!qóœ[)ÚúÞçøƒŠº¾*Ü/X"Œê@µð¶¨$p1£B5iÚ Ú†õÊ¬É¦E3^ür¾auD»ëêA)d„ÏHzYÁepƒê¬~ô¡œ8e‡ñˆÖM&èæ<ëâM"-¹uSÂÖøsBŒiÓÑ!³ÊÅwÛÃ¶>kHåO'dyÁ(<Ýx´Ÿì¸¤˜)èÀ©@ëQæ‚Ëã:04q-‡è—žÄ"tÌÀ±IŒW1p–Ì‡bïV¢¼-$»¥ˆlË*Ê^¡´ZK ×±›mßhœôNþ`‰û§4p9 þ]Ùö®u*)ú24qØI£–]†#8kÐ>a…t fö¾¶+k—a ?L¯¶ƒÎµÜz‘k†—)+¥qþÞ \®qÔª|ãO¹¥ô?I°®íÉ¨‘‡3 dÿë€ìV&"+Ï}*Lí€Ÿh"p  Ø"ð¶Øäç6ˆkƒ¹òÓ@FK²Ä?åüï<:CˆšÛƒ1J®b™ý)žy´ÔÄ¶a™_Áïx^—õö6Ãqc€õš¾©÷M—¡å´7ÁÑ©Nà›¶AÚ¢öEM:"¶Ž4iáîµ&Cþ²Pû¶££.ÿ *?©ñÞ`&ÞGøó§¦_B¸‡h–¦éÞæ'è£©n¥êý5‘¿kcñV‰1?xçÛ#”C0ÒÁià¿0Ÿ¥çWdÅ˜]íhæS'ã'–ÿðò§ü‡ì¨šãfïï Á0ó7kÀ%±N“£\Br)"úklìŠ¢˜˜[’€:º–Í  GaùÛaçˆwsÔÚ‚õòSd›±ltWZ›è_¹ªÿã§%ÉÞxî³«ŸKÊMUYÜJ@Šý+BBL¤®Š±    Â„¼‚ÈûæÀŠBñã“„º/oú–·fJäƒrÀ°‡¤N2¸×kìô"aõÙ%ÚÂWŸÿ–†Œ»Còc?…£Rw4ËZ_W§{b™”î—/Ä¾›:ºj;U.½ÓM “É¥8T37?¿UÃh5Ä½>éÎÔášÄxÃ€¥ä·$í÷äÕÖ·¿Oowç<ÖÅ!XNâjW”öb1GâÔ¯yYÇ+¶pL´[sŠÍT.×KXNK“kh-ñ@bÌÜ^Ü÷]é ¿}fkøD‡0GE îŽï˜;pÂsŠ¶ZfÀ§1gjõÂcøwãj•‡'BšÓ{»£¬²BhaA2ÿT Ë~S{‹øÏàïnñhÁn ýˆÜzŽ*`5ÉŽAsqaùðÄ¶ü¿ƒ 5g>ë¥Uå!-£SÂr–ELÿ*à&;½¤&›y™Ž6¼³ªø OÌ‡MP÷G©‹:ø_•ÜAaA«jb;‹¨ÓÅ Ä¹‰¤¼l*S ï?ö„óÑ    žsÌ=,&å x— a´è2éòyÄlÝŠ*žÄ¥ÆnÀ¨ã³¡ ÝòÆFƒDÁ*DÂ   ;™±™½fÀßÃ¥‹{â«ZËÅøÁY‚Œ”².—ÆÀMuüÃÙR™;c6ì€Î®û°Éƒ„bÐ–{íWáßõíì’¬¾ßaÙ°^læ¿r{ƒ,ãaÃ¬?ZÞ‚á>m9‚€’Ñ§Ñú\VFÏ\b¶c'E¨)óå€Â˜¾bæ¿;nðî¶Äê=fè8cÊ©"¹K sF¢Æš³   ²ˆô6*®&Øç$î6ÐZÆú”Ž‹S¹)šå‡j¶ý¥¹3áBy+ìç°ÏHHg®™:ä`Oà^4Æ–(Øx$…ÖýdÎÞfvr"ÙCU¼Áë¸;½›ÂMy.fRlÓûñ9HÕ6V•.–‚“3¬ig_HSÀíñæ…ïþqž—7¾_;ó«(«ãøguBš"ã·pÓïvŠªÜ²•tÚÒ=Jî„d|¤MxžŠÝ’Œ>(K_>ÏQl¯?2šËŒÂ(twQû¡&ÌøŸ=Þ‹%âAœ LÇNjnYNæø }iÏaQx‘dO6ô¬z`oÔÝ.Ç"~]1¼@Ô¸tÏnÀZì»g¤'ãÜÆ' MbOÆ@R,I.ŠhéD›PAn'3áyþ‡5±+  xßM|T‘~Ð3¦èd-ï`S•![¹·)ÓÿQ'!‰]½+lkŸ+©àtk«HÂË»Œ"Zï¨ÓCú «@

This is not secure. You have only 2 rounds of SHA-512, which is not computationally complex. Your salt is also a variable length (between 0 and getrandmax() bytes), which means storage will be unreasonably large (an average of 16 kilobytes of storage for each password?!).

Please do not attempt to create your own password storage system. Use one of the proven solutions: PHPass, bcrypt, PBKDF2, or scrypt


Active directory based permissions SID, username or email? My application has a table with the permissions to the screen it has. Which of the following should I use to store the permissions against:

sid
username
email
other

It's in an internal enterprise

Your question is a bit unclear, but it sounds like you want to grant permissions in your app using AD properties associated with an account the user authenticates with.  If that's correct, you should use the SID as that is the intended purpose of that property, and it is the least likely of the properties to be changed.  A username, an email address, or other account properties can be changed or reassigned, but the SID will remain the same for that object throughout its life in a domain.


Are there any logic-bombs that execute when the file is deleted? I want to delete a suspected malicious file from a server. For the purposes of this question assume that the infected machine is Windows Server 2003 or later.

Is there any risk in deleting such a file? Specifically, are there any logic-bombs that are known to execute when a file is deleted, i.e. the triggering condition is that a user attempts to delete the file?

Aside from updating my virus database, are there any precautions I should take?

If the machine is already infected, it is very difficult to know what is going on with it. You can never trust it anymore.

The malware itself could be sitting in the memory and watching its files. It's certainly plausible that a malware would do that, specifically so it can regenerate the deleted files. Remember those autorun malware? Whenever you deleted them from your disks they magically appeared again? Yup, it's pretty much like that.

The only way to clean your machine and be sure is to "nuke it from orbit".


Is AJAX fundamentally insecure? Possible Duplicate:
  How to do Ajax securely?

At my workplace many people believe that AJAX is fundamentally insecure.  I am under the impression that AJAX is exactly as secure as any other page load, it depends on how you code the call/page.

Is there a fundamental security flaw in AJAX?  How does the attack surface of AJAX class (regardless of XML or JSON) differ from a standard, synchronous web application?

The answer depends on what assets you're trying to protect and your threat model.

If you're worried about the user attacking your web page content and the AJAX code in it and discovering something in the page that you didn't want them to know, then it is true that AJAX is insecure, since the user has physical access to the environment that the web page runs in.  An example of this is the gaming example that Thomas describes in one of the other answers.  If the page implements a game interface and includes information on where other players are, then the user can figure all that out and  "see thru walls" and could cheat.

On the other hand if you're worried about the user attacking your server, and you assume the user can modify anything in the web page and associated code, and you take proper precautions to protect your server against anything the user can do under those circumstances, then as others have noted AJAX is just as secure as any other good programming technique, and it mostly depends on your server side code, as always.
Update: But doing so can be tricky, and as @iivel points out, an OWASP page explains the various things you'll want to watch out for: Testing for AJAX Vulnerabilities (OWASP-AJ-001)

This all applies to other client-side techniques like Flash or Java applets or Silverlight, etc.  Heck, it also applies to Word or PDF - if you put content in there (like meta information on who the author or owner of the software is, or content that is "erased" by overlaying it with digital white-out) that you don't think people will see or you didn't even remember that it gets included automatically, then you'll be sadly disappointed when a savvy user looks at the bits.

It's really important to think carefully about your threat model and whether your tools address it.


Any vulnerabilities in allowing users to choose path of S3 file? I'm building a web app that uses S3. In some of our operations, we're creating a file on S3 with a path that's directly dependent on user input, so an attacker might cause a file to be created on S3 with whichever path he wants.

Is there a way for an attacker to leverage this into an attack? (A few ideas that came to mind were using magic file names, or feeding very long paths, but if you have other ideas I'll be happy to hear them.)

If there's a serious possibility for a vulnerability, we'll consider redesigning the system.

The two possible vulnerabilities that come to mind are Path Traversal and XSS.

To protect against Path Traversal validate the path input to make sure the user cannot change it to include characters such as .. or / or their encoded versions (e.g. %2e%2e). If they could there is the possibility that your application (or the S3 API) would interpret the characters to be the parent or root folder.

For example, if the user was saving on S3 in their /foo folder and they set their folder name to ../bar/ you should make sure the file is not saved in /bar instead (which may be another user's folder).

XSS is only an issue if the domain is shared with any application code that uses cookies. Unlikely in this scenario, but thought I'd mention it just in case. This would also only really apply if the user could influence file content such as being able to include <script> tags and then reference the page as a HTML document that a user could be enticed to visit which would then transmit cookies to the attacker.


What are the enhancements of SHA1 compared to MD5? I am looking for enhancements of SHA1 when its compared to MD5. But I am not talking about just heap sizes. I am talking about different enhancements than heap size.

Also, I think md5 is faster than sha1. It can be a difference between them.

Are there any improvement sha1 and md5?

Cryptographic hash functions are objects which try to fulfil some properties (namely, resistance to collisions, preimages and second preimages). An algorithm which fails at offering these properties is said to be "broken" and, by definition, should not be used in protocols where the unfulfilled properties are needed.

MD5 is broken (for collisions). SHA-1 is not (at least, not as much). If your protocol requires resistance to collisions, then don't use MD5. E.g. some researchers have managed to make fake certificates by using MD5 lack of resistance against collisions.

Right now, SHA-1 is "slightly weakened" with regards to collisions, but not sufficiently so that producing an actual collision has been done. It would take a substantial amount of time and computers (months, thousands), hence quite some money. A contrario, MD5 collisions can be generated in less than one second on a basic PC.

SHA-1 is slightly slower than MD5 when processing bulk data, which does not matter as much as is usually believed. When a basic PC (again) hashes big files, the hashing part is actually three times faster than the reading-from-disk part when using SHA-1. That MD5 is about 40% faster than SHA-1 won't actually matter, since the bottleneck is the disk, not the hashing.

SHA-256 and SHA-512 are the currently recommended general purpose hash functions. They are slower than SHA-1, but still "fast enough" for most purposes. They don't have known weaknesses (even theoretical weaknesses).


How to determine what type of encryption has been used? i play an android game which seems to send the player's high score in an encrypted format .
some thing like (f11cca35236eebbdc26a0ce45876d117)
a 32 character code
tried MD5 but no result found.
i wanna know is there any way i could decrypt it or at least find the encryption method?
thanks

First of all, it sounds like you're trying to cheat at a game. Don't do that.

Now some background on what is going on. Lets first look at the difference between encryption vs hashing:

Encryption is the process on encoding information in such a way that it can be decoded again given the right information about the encoding process (such as an encryption key). This is used for secure communications such that the recipient understands a message (and is able to retrieve the original) but third parties are not able to read the message. The process goes something like this:

"Message" » {secret formula} » (scramble) » {reverse of secret formula} » "Message"

In other words what goes in can be gotten out if you know the secret. Obviously in this scenario what the secret is is pretty important. In computer cryptography is is usually not the formula itself that is secret, it is the values used in the formula that are the secret keys. More on this in a second.
Hashing is the process or reducing a blob of information down to a single value (usually of a fixed length much shorter than the original) that is unique to the given input. This is can be used to confirm the integrity of a message but does not actually contain the message. This looks something like this:

[Value1] » 7a258c461b48c794c0b5110b35382d1e
[Value2] » 926e0eddb765d66502eac40a4ead9409

Hashing is often used to store passwords. Note that this is a one way operation. Given the same input you will always get the same hash1:

[Value1] » 7a258c461b48c794c0b5110b35382d1e
[Value1] » 7a258c461b48c794c0b5110b35382d1e

But one cannot know just from the hash what the input was2.

That background aside, MD5 is a hash algorithm. It is not likely that your game sends hash data back to the server because the data would be uninterpretable. It wouldn't tell them what your score was! You can pretty much rule out anything that is a hashing algorithm.

Now there are two basic ways an encryption process like in the first bullet point above can work.

The same secret value can be used both to encrypt and decrypt the content.

This is the usual pattern for things like password protected documents.

User A uses {password} to encrypt a document.
The encrypted document is passed around.
Only users that know {password} can decrypt and read the contents.

A matched pair of values can be generated such that one half of the pair is used to encrypt content that only the other half of the pair can decrypt.

User A generates a key pair.
They then pass around the public half of the key pair but keep the private half to themselves.
Any user may encrypt documents or values using the User A's public key, but the resulting data may only be decrypted by User A using their private key.

If you game uses a basic password model as in #1, the password and algorithm used will be hard coded somewhere in the source code and burred somewhere in the actual app. Anybody that does some dissection work will be able to figure out what that value is and decrypt any further messages they intercept. Hopefully your application did NOT do this!

The proper way would be for to public key cryptography as in #2 above. The software developer would have generated a key pair for their software. The public half would be built into the software somewhere and all values can be encoded using that key before being sent over the wire. Once they reach the developer's servers, the data may be decoded using the private half of the key.

Conclusion

If the developer has used the proper technology for the job, you will not be able to decrypt the data being sent because you do not have the private key needed to decode it. The public key may be buried in the software somewhere, but that will not get you the data.

If they have NOT done their job properly then there might be trace clues in the software itself that give you enough information to decrypt the data yourself.

Actually identifying the method and specific algorithm used in this case is beyond the scope of this answer and is left for the reader to do further research on. Hopefully this overview of the possibilities will provide a better understanding of what sort of things you are looking for.

2 This is why using salted hashes is paramount to the security of password systems!

2  Note I said just from the hash because is is possible to guess or use pre-defined tables  to know what input generated a hash, but a secure hash itself will not actually contain the data used to generate it.


Questions towards my application that uses bouncy castle crypto I am implementing an application using bouncy castle crypto API it uses AES-CBC to encrypt files and i have some questions regarding the development of my application.

I dont want to use a static IV (due to security reasons) how do i go about it? do i have to append the IV to the file and then when decrypting extract it?
During the encryption of the file the application creates a new file with a .enc extension where the encrypted bytes are written. When the encryption is finished the unencrypted file is deleted. Should i have any concerns that an attacker could recover the unencrypted file (this is an android app so the underlying storage technology is flash, and i am using the standard API to delete the file) should i implement a secure delete function or how to deal with this?
The files are encrypted using a 256-Bit key derived by PBKDF2. PBKDF2 needs a salt for which i use a hash of the users password is this a bad idea? does the salt has to be random? if so how do i deal with it do i have to append the salt to the file to perform decryption?

are there any good books on bouncy castle?

it uses AES-CBC

You should probably use EAX mode instead of CBC. It will prevent the encrypted data from being tampered with (with almost no effort), and it will protect you from certain edge cases that effect CBC mode. See this answer for a discussion of different modes.

The only changes you'll need to make to do this are to use EAX instead of CBC, and you need to use a key that's twice as large (a 256-bit key if using AES-128, or a 512-bit key if you're using AES-256). You can make PBKDF2 generate a key of any size, but make sure the output is the native output size of the hash function, so if you want a 512-bit key, use PBKDF2-HMAC-SHA512.

  I dont want to use a static IV (due to security reasons) how do i go about it? do i have to append the IV to the file and then when decrypting extract it?

You can store the IV however you want. It seems common to prepend it to the data (prepending is slightly easier, because you can read the file from the beginning without jumping around). The OpenPGP format is nice because you can use other applications to read and write the files (and the format has had a lot of attention, so it probably handles cases you haven't thought of yet). I've written programs that output a JSON file, with the base64 encoded encrypted data, and the IV as attributes. You could use XML. You could distribute the data and the metadata as separate files. It's really up to you.

  When the encryption is finished the unencrypted file is deleted. Should i have any concerns that an attacker could recover the unencrypted file (this is an android app so the underlying storage technology is flash, and i am using the standard API to delete the file) should i implement a secure delete function or how to deal with this?

When you delete a file, the filesystem usually just marks it as deleted so other files can be written over the top. To fix that, you would need to write over the file, but I'm not sure if there's any way to guarantee that on a journaling filesystem, especially if it's using flash (because flash controllers usually move blocks around for wear levelling). You could probably do this by deleting the file, then writing a giant file that takes up all of the free space on the device, then deleting that file.

The best way to guarantee that private data isn't left unencrypted on the disk is to never write it to the disk unencrypted, but it sounds like that may not be an option for your program.

  The files are encrypted using a 256-Bit key derived by PBKDF2. PBKDF2 needs a salt for which i use a hash of the users password is this a bad idea?

A unique salt will protect your system from a large number of vulnerabilities, so you should definitely use it.

  does the salt has to be random?

It doesn't necessarily have to be random, but it does need to be unique. Randomness is usually the easiest way to get unique values.

  if so how do i deal with it do i have to append the salt to the file to perform decryption?

Store the salt the same way you store the IV.

Your probably also want to store the number of PBKDF2 iterations, so you can increase the default in the future, and still be able to decrypt older files. Make sure your iteration count is high enough. For comparison, iOS uses PBKDF2 with 10,000 iterations when storing passwords. Unless your program is running on a toaster, you have no excuse to set the value lower than that.


Is OWASP ESAPI .NET Edition really used? Is this project still alive? I have just seen that the last release has been pushed out in 2009 and that raised my doubts.

No, as you've noted, it was abandoned in 2010, and is completely unsupported and thoroughly outdated at this point in time.  You should definitely look somewhere else, and where exactly depends on your specific needs.


Can GPG be a full replacement for PGP? I am working on automating a PGP process and plan to replace using PGP with GPG. But I need to make sure GPG can actually be a replacement.

Does GPG do everything PGP can do? I've researched a lot and it seems like most of the basic features are available, but I cannot find a SDA option in GPG.

Self-decrypting archives are a bad idea.

They are a self-inflicted security exposure. You're sending an executable file to someone and asking them to execute it?  And then, just to add gravy on top, you're asking them to type their password into this untrusted program they got from who-knows-who? Nuts!  That is effectively training people to behave in an insecure manner.  Using self-decrypting archives is just asking for problems down the line.

Using a self-decrypting archive is a statement that you have a file so sensitive that it needs to be encrypted, but so harmless that you are asking the recipient to throw caution to the wind and disregard standard security practices.  That doesn't make sense.

Personally, I think that GPG's lack of support for SDA's is a feature, not a bug.

Further resources:

Don't use self-decrypting files.  "Self-decrypting files are not cool at all."  "Self-decrypting files are a man-in-the-middle attacker's dream come true."
Is creating SDA's possible with GnuPG?  "These are an incredibly bad idea. So,
no."


How to block some websites in a small office? I had a wireless connection in my office with one laptop. Now I bought two more laptops for my employees, and I give them Internet access. I want to block a few websites.

My current connection is uses a basic modem-cum-wireless-router which doesn't have any web filtering feature. So I guess I need another piece of equipment.

What kind of equipment do I need to do to filter the web traffic and block a few sites? How should I go about configuring it?

I believe that you can do this with OpenDNS.  You can probably learn enough of OpenDNS in a few minutes to do this, and as a side effect you'll significantly improve your overall security and quite possibly your reliability and speed.  Alternatively, depending on the router you have, you could flash it with dd-wrt (or CeroWRT or tomato).  This requires significantly more technical skill, but will result in a much more powerful tool. (and if your router doesn't support one of these, you can buy one that does for under $100).

Of course so long as the employee's have administrative access to their laptops and either a modicum of technical skill or the ability to follow directions on the internet, they can defeat all these measures.  Depending on how important it is to you that these sites be filtered, you need to detect violations as well as prevent them.  Much of the ultimate answer depends on how much assurance you need.


Can Suricata IPS detect and prevent ARP poisoning attacks? Does Suricata IPS have the capability to detect and prevent ARP poisoning attacks? Snort uses a preprocessor that decodes ARP packets and detects ARP attacks, but I couldn't find any such capability mentioned for Suricata IPS.

Arp attacks related to layer 2 of OSI model. Suricata and Snort IDPS is developed to detect attacks at the higher level of OSI model. Suricata doesn't have mechanism to detect such type attacks. Snort has a preprocessor to detect arp attacks but that needs some configuration. I have worked on that and I didn't found it useful because sometimes it will not work. The main drawback of snort arpspoof preprocessor is you have to manually specify the ip and hardware address to arpspoof-detect-host. The host and snort should be in the same layer 2 segment. To prevent such types of attacks the best solution is to use layer 2 device Switch.


Suspicious email with my information in it: what do i do? I just received this email:

Billed To:
d**********@****.NET

John ******

Order Number: M1V62***2711
Receipt Date: 07/12/12
Order Total: $699.99
Billed To: Credit card

Item Number     Description     Unit Price
1               Postcard (View\Download )
Cancel order   Not your order?Report a Problem  $699.99

Subtotal:   $699.99
Tax:    $0.00

Order Total:    $699.99

Please retain for your records.
Please See Below For Terms And Conditions Pertaining To This Order.

Apple Inc.
You can find the iTunes Store Terms of Sale and Sales Policies by launching your iTunes   application and clicking on Terms of Sale or Sales Policies

Answers to frequently asked questions regarding the iTunes Store can be found at http://www.apple.com/support/itunes/store/

Apple ID Summary ГѓВўГўвЂљВ¬Г‚Вў  Detailed invoice

Apple respects your privacy.

Copyright ГѓвЂљГ‚В© 2011 Apple Inc. All rights reserved

I removed some characters of course to protect my information. Heres the thing, i don't use a credit card for my iTunes, i ALWAYS just buy gift cards and use it that way. It has all of the logos and images usually associated with an apple email. The sender is itunes@new.itunes.com my question is: is this a legitimate email or if i click on the links am i probably going to get taken for a ride? The thing is is that this email isn't even associated with my iTunes account, this is my work email. Whats the deal?

if this question is not on topic here, I'm fine with it getting migrated, I've never posted a question here and I'm not sure if it is within the scope of the site.

EDIT

I checked all of the links on the page and they all go to here: tomjames.comcastbiz.net/check.php

I contacted Apple support and this is what i got back:

  John, many customers have recently reported they received a similar email. I'll be glad to provide as much information as I can. I've looked into this for you and found that neither the email nor its sender are affiliated with Apple. The email appears to be a phishing attempt, designed to trick users into visiting a website. Fortunately, the purchase indicated in the email is not a real charge. I've checked your account to be certain.

As your edit shows, this was a phishing attempt by someone who controls:

tomjames.comcastbiz.net/check.php

Relax.  They do not have your secret details (unless of course you went to their site and gave them more information) besides your name and email which probably isn't secret information.  You do not have to do anything.  You potentially could report the link to some anti-phishing sites or your email provider if you want; but sometimes its best to just ignore it.

http://www.us-cert.gov/nav/report_phishing.html

http://www.google.com/safebrowsing/report_phish/


Are variable time comparisons always a security risk in cryptography code? I came across the cryptography python package, and noticed it had the following about reporting security vulnerabilities:

  Examples of things we wouldn’t consider security issues:
  Using a variable time comparison somewhere, if it’s not possible to articulate any particular program in which this would result in problematic information disclosure.

I thought having no variable time comparisons was one of the things cryptography implementations ensured to be secure. Should this be a goal of all secure cryptography libraries? If not, under what conditions does it not make a difference to security whether or not a constant time comparison is used?

No, they are not always a risk, and indeed, it is impossible to build a practical cryptographic library where every function is constant time.

Take, for instance, a decryption function. In a real-world cryptographic library, it is going to be faster to decrypt a 10 byte message than a 10 gigabyte message.  You could theoretically create a library where decryption was constant time for any message of supported size, but that would be absurd, so you have a variable time function that leaks (useless) information about the size of the message being decrypted. One of the specific reasons that this isn't an issue is the assumption that the attacker may have information about the message size is built into the security proofs.  Security properties are generally designed to only assume security for messages of a specific size, and since they don't apply to messages of different sizes, there is no impact to the designed security of a system if message size affects function completion timing.

In other cases, timing may be potentially sensitive, but a function may be designed to eliminate any information an attacker could use against the function.  Double-MAC'ing is one example of this.   Evaluation of a MAC is very definitely a function that is sensitive to timing attacks.  In an (for example) encrypt then MAC scheme, you compare a MAC sent with a ciphertext with a MAC freshly computed against the ciphertext, a timing attack could allow an adversary to repeated submit modified ciphertext/MAC combinations and iteratively compute a valid MAC without knowing the correct secret key.  If, however, on every comparison you re-MAC the MAC with an ephemeral key and re-compare, it doesn't matter if there are timing issues.  The ephemeral key in the second MAC will prevent an adversary from being able to iteratively produce a correct MAC because the new ephemeral key produced for each subsequent evaluation will thwart the effort to discover valid bits.


Where to find about web application vulnerabilities' history? There are many web application vulnerabilities out there, such as XSS, CSRF, and etc, and there are many resources which explain them very well. But I want to find about their history, for example, who was the first to discover them [Surely, it wasn't a single person], and when they were first discovered [Surely, they weren't discovered at the same time], and so on.

You can

search the CVE list for keywords or specific CVEs and
search the NVD of the NIST.

Those two links should be fine to answer questions you might have about individual vulnerabilities - not only constrained to web applications - although they do not usually disclose the actual person that found the vulnerability.


Does prefetching/preloading in web browsers pose a security risk? Today I googled the name of a domain that was reportedly serving up malware.  My search results came up (with the compromised domain at the top of the list) and within seconds my AV gave an alert saying that it had detected some js malware in my temporary files.

I had only searched for the company on google. No clicks were made. Therefore, I'm assuming this detection is the result of prefetching performed by Google Chrome which must have loaded the malicious file.

My question is:  could this malware execute, or would it be sandboxed by some safety mechanism that might exist for the prefetch/preload pages?

Pre-fetching as I understand it in Google Chrome performs things like DNS lookups and static content caching. In order to determine what static content to download, some parsing of the HTML document it pre-fetches must be conducted and it is known that browsers have been vulnerable to malicious HTML payloads in the past (Internet Explorer CSS and HTML parsing bugs leading to shell-code execution).

One must then reasonably conclude that yes, pre-fetching does pose a security risk to users in the sense that it downloads and processes essentially code from pages that you may not have intended it to.

I am presuming that the pre-fetched processing logic still enforces the same-origin policy requests but again depending on how separated the pre-fetching logic is to ordinary page loads there is a possibility a vulnerability exists here which only occurs when a malicious page is pre-fetched rather than visited directly.

Given the somewhat limited benefit of marginally faster page loads, I'd recommend if there's a chance you're frequently visiting pages that reference known malicious pages (e.g. because you're doing security research) it is worth disabling pre-fetching.


How do I know whether the RAT tool (cracked/) I am downloading isn't backdoored? In a simple way?
If I use VirusTotal (for example) how do I differentiate if it's just the RAT or if it's also backdoored? Or is there software to check?

The problem of assessing the security of "blackhat" software is, as you've mentioned, that many automated checkers will flag it due to it's purpose.

So this leaves you in a situation where you'd need to either "trust" the vendor, as @steffen-Ullrich says in comments or complete a manual assessment of the tool to ensure that it's doing what you want.

One approach to this would be to deploy the tool into an instrumented environment which can log changes in system files and network traffic and then put it through it's paces.  Then review the logs provided to see whether the changes and traffic that was generated meet your expectations.

Of course this runs across all the possible problems of the tool having implemented anti-forensics technology either as part of it's primary purpose or as past of a backdoor.

If you have access to the source code you could obviously review that, and then ideally build from the source code you have.  Assuming you've got the capabilities to complete that review, then that would provide more assurance.

Fundamentally it depends on how important it is to you to assure this software and the level of effort you're willing to go to.


Are Web Views in android secure? "Web Views" are views that display some online content, usually a webpage within an android app.

Implemented "Web Views" usually don't seem to have any kind of status bar or an address bar to confirm if I'm on the right website or not. Thus making it a perfect exploit for malicious apps to serve web page that can be used for phishing, say like a fake facebook sign in page that could steal my credentials with little or no suspicion!

That being one of the issues, I'd like to have a more detailed and definitive answer.

So are Web Views secure? What risks do they contain?

Let me ask about a few points on this:-

Does the web view pose the same security holes and flaws of the stock android browser (Because it is a derivative of it?)
A "remember password" dialog often appears for password submission forms in Web Views. Are the apps entirely isolated from this 'password store'?
Can apps possibly 'inject' some code into the Web View to track keystrokes/taps?
What other  parts of the Web View does the app have access to?

I hope this question isn't too broad.

Not exactly what you asked, but I see people miss this often enough that it's becoming an issue.

JavaScript bridges are used to break out of the browser sandbox (feature). However, for apps compiled for API level <17 (even if you're running latest and greatest but the app is compiled with lower API level, it is vulnerable), one can use reflection to execute ANY Java code from JavaScript (see Abusing WebView JavaScript Bridges).

Let me reiterate: with JavaScript bridge enabled in WebView, a "webpage" can execute any code as the WebView application.

More references:

http://developer.android.com/reference/android/webkit/WebView.html#addJavascriptInterface(java.lang.Object,%20java.lang.String)
http://developer.android.com/guide/webapps/webview.html
http://android-developers.blogspot.co.uk/2013/02/security-enhancements-in-jelly-bean.html


Create PKCS7 signature, signed by X.509 CA, which embeds an XML file I have to create a PKCS7 signature file signed by an X.509 certificate and I have to embed an XML file within.

How to do that with OpenSSL or any other tool?

To be clear, the data to be signed is exactly the contents of a file, XML or otherwise?

You can't sign with only a certificate. You must sign with a privatekey and then provide the matching certificate to allow the recipient(s) to verify the message when they receive it. When using a certificate issued by a well-known CA (e.g. Verisign) you usually must provide a certificate chain not just the single certificate. Some UIs (especially Windows and at least some other browsers) confusingly use the term "certificate" to mean either just a single cert by itself, or a combination of a privatekey plus one cert or a chain of certs.

OpenSSL actually supports CMS (Cryptographic Message Syntax) which is the updated IETF version of PKCS#7, like TLS is the updated IETF version of SSL. If the very small technical differences between the older version PKCS#7 and the current version CMS matter to you or your recipient(s), you will probably need to write a custom program, which can use the OpenSSL library. OpenSSL also supports S/MIME which is basically just CMS adapted to MIME format (used in Internet-email and HTTP).
To confuse things a bit, current OpenSSL commandline has two subcommands:

openssl smime ... an older utility that actually supports both S/MIME and CMS
openssl cms ... a newer utility that also actually supports both CMS and S/MIME

See https://www.openssl.org/docs/apps/smime.html and https://www.openssl.org/docs/apps/cms.html .

The simplest case of signing with embedded (not "detached") data is if you have the X.509 cert and privatekey (both) in PEM format in a file:

openssl cms -in datafile -sign -signer keyandcertfile -nodetach -outform pem|der

Select -outform pem or der depending on which output format you want, but don't omit it; the default format is S/MIME which is not what you asked for. Output is normally on stdout, which you can redirect or pipe to something else as appropriate; add -out outputfile to write directly to a file.

Variations: If you have the key and cert in different files, but both PEM, you can either just concatenate them into one file, or use -signer certfile -inkey keyfile.
If you need to supply a chain cert (or several) and you have it (or them) in PEM format in a file or files, add -certfile chaincertfile once or as many times as needed.
If the "certificate" (and privatekey!) you have is in any other form(s), OpenSSL can convert many other forms (though not all) to the PEM files it prefers; provide more exact details. (Edit your question by clicking on the word "edit" at its bottom; for clarity state which data is added or changed.)
If your data is not exactly one file, but can be selected or otherwise produced by some other program, omit -in inputfile and instead pipe the input of openssl from that other program.

All this assumes OpenSSL is available on the system you use, or equivalently you use a system where OpenSSL is available. If you need to obtain OpenSSL, specify your OS.


Phone conversations being recorded and played back Regarding below post from 2014, I have the exact same problem with every call I make to Lebanon.
How do I stop this? Is it a bug?
I have factory reset my phone and it's still happening.

My wife called a GSM/3G number abroad and the call was dropped. She called again and she could hear the whole conversation repeated with the other party but with blank period from her side of the conversation.
How can this explained?
The call originated from Saudi and terminated in Lebanon.

This looks like a malfunction and to prevent it from happening (i.e. others listening to your conversations as well) it's best to report it to both carriers:

By email, and include:
Date and time of conversations with timezones
Source and destination number
Description of the problem


Secure process threads I was pondering my computer theory and this question has been bugging me for a while .

Is it possible in some way to have a running process with its memory "encrypted" on an insecure system ?

If some one started a thread and its bits where encrypted with a key would`t it have to have its key visible in ram any way ?

I use a lot of remote virtual boxes and want to know if they can even be secure platforms . I can`t think of anything though that would stop the host from peering into the ram .

In virtual machines, the host is God. It can do anything. Even if you could keep all data encrypted (which would be expensive -- e.g. see this question), it still must be decrypted at some point within the CPU, so that processing can take place. The host has complete control of the CPU.

Encrypted RAM may be useful only in contexts where the CPU is assumed to be honest, and you try to defeat external peeking into the RAM (e.g. cold boot attacks). If your CPU is itself hostile to you, then there is little you can still do "securely" (although some people tried).


What to do about "SSH Protocol Version 1 Supported" warning? We have a Windows 2003 SP2 server system. Upon doing a security scan we have found out that we are getting:

SSH Protocol Version 1 Supported Vulnerability
Threat: The consequences of vulnerabilities present in SSH Version 1 include:

SSH protected traffic compromise
root shell access to the system running SSH server

What steps on the Windows side can we take to remediate this issue?

Why are you running SSH?

Having an SSH server running on Windows 2003 that you do not know about is highly suspect... it is not an included service.

Step one is to figure out why SSH is running, and if it even should be at all!  A great place to start might be seeing what binary is opening the port with netstat -anb.

It might not be for providing a terminal.  Some third party FTP servers offer SFTP which runs over SSH.

Hardening SSH

Provided that you are intentionally running some SSH server product, your goal would be to harden its configuration by disabling SSH v1 and insecure cipher suites (think MD5/SHA1, etc).  Ultimately this is specific to what you are running, and would almost be a second question about that specific server software.


Gmail Contact List Safety How can I know that my Gmail is spoofed or sending spams to other people I sent email to them before? I don't have clear signs of that especially my contact list is empty but I'm afraid this may happen later as I clicked on a strange link in a mobile app.

If someone spoofs your Gmail account, there is no possible way for you to know that. That would be like being able to know if I introduce myself to others as Ali Zahy. The receivers would know if they inspected the headers of those emails, though.

You might be able to determine if your actual account was used to send emails by looking at your sent and deleted folders. But if the malicious emails were permanently deleted, there would be no way for you to know. But, again, the proof is on the receiver's side.


How to report unsuccessful attacks to the source network admins? I am not an information security professional as such.  I am a self-taught web developer so I hope this question is not too basic.

I have set up a web store via WordPress using WooCommerce and because of this, I have also set up some security (iThemes Security) to monitor login attempts etc.  iThemes Security has highlighted a few attempts over the last 2 months which have been thwarted due to either strong passwords or the fact that "admin" is banned as a username.

Running whois searches on the RIPE whois database, the IP addresses of the "attackers" came up with FOP Tokarchuk Oleksandr Stepanovich in Ukraine (abuse@fregat.net) and World Hosting Farm LTD in Ireland (abuse@worldhostingfarm.com).

FOP Tokarchuk Oleksandr Stepanovich in Ukraine
There were 11 brute-force attempts 2 months ago (invalid logins) and 3 brute force attempts today trying to use "admin" as username

World Hosting Farm LTD in Ireland
There were 6 brute-force attempts 3 weeks ago.

The store is not live yet as the stock database is being built at the moment so no information on customers would have been in jeopardy.  Each attempt has resulted in 2 hour lockouts for the relevant IP addresses, and emails were sent to me from the website telling me that they were locked out.  I have then converted their lockouts to full bans so theoretically no more attempts can be made through those IP addresses.  Hopefully I am right on this.

What I am wondering is whether I should contact the relevant responsible organisations via the abuse@ email addresses?

If so, should I send a full copy of the logs relevant to the attempts or snippets of the logs relevant to the IP address and the times of the attempts?

Don't lose your time pursuing those guys or litigating. Unless you have how to prove that you had a sizable financial loss, and you can prove the user controlling the computer that uses IP, you can not even start a litigation.

You can send a mail to abuse@, but don't hold your breath. You are putting an ISP against its client, and the ISP will defend its own client, unless you have a very strong case against the user. And even so, probably the ISP will not move a finger unless you litigate. And if you are not in Ukraine or Ireland, don't think their courts will help you.

On the other hand, blocking the IP for a couple hours will help immensely. Pairing fail2ban with iptables, and blocking any IP trying to access the admin area, or hitting too much HTTP 404 errors will protect you from most automated scans.


Multiple passwords, same account, different privileges Many of our clients in the field often need to use untrusted computers to access their account on our website (no 4G/WiFi). We have had multiple cases of credentials being leaked leading to several erroneous sales and refunds, and more importantly, it has inconvenienced them greatly.

As a stopgap, we're considering creating multiple passwords for each user-- one would give them full access, while the other could be used when they travel and doesn't allow purchases, and has stricter session requirements. This is a legacy website that we don't plan to invest more time in, and our clients are technophobes.

Is there any reason to not do this?

The inherent problem is that the computers are untrusted - multiple passwords going through the same untrusted channel won't really help, and may confuse your clients more than help them.

I would strongly suggest adding a second factor authentication via a trusted channel like your client's smart phone. 2FA does not have to be onerous or complicated.

Begin by making the feature optional, but advertise and recommend it to your customers. Collect feedback and audit whether clients who enable 2FA ever get their credentials compromised.


Is it possible to write a value larger than 64bit using a format string attack (%n)? I am currently exploring format string attacks. However, the buffer in this example is not located on stack but on heap, so the most common approach does not work and my options of addresses I can overwrite seem to be limited.
Assume I need to write on 0x18 but nearest the address I can use with %n is 0x10. Is it possible to set up a format string which will allow me to fill the memory until I reach the right location and then write an arbitrary value?

Compiler used is GCC 5 on Debian OS x86-64.

assuming what you mean is that you want to write in the middle of your 64 bit address, because your on a 64 bit system you could just create 8 byte array and add them to an unsigned long long
kind of in sudo code:

//get the pointer to the nearast address
unsigned long long * datapointer = 0x18;
//get all the data from the smallest adressible chunk for your system, in this case 64 bits
unsigned long long data = &(datapointer);
//some values of individual bytes you want to override
uchar a = 0x23;
ucahr b = 0x99;
...
//clear out the bytes you want to change
data = data & (data mask to be overidden);
//change the desired bytes with the desired values
data = data | a << (byte number for a in bits);
data = data | a << (byte number for b in bits);
//override the data chunk
&datapointer = data;


Adding HTTPS API to legacy hardware system that uses short numeric passwords I work with a hardware system that traditionally authenticates users by the entry of a short numeric password on a physical keypad. Despite the small password entropy, this system has proven to be fairly robust because mechanisms are in place to detect brute-force (repeated incorrect password entry). Each user has an associated name string and numeric password. The name string is used only for administrative purposes and not for the authentication process. So, to be clear: The only way for a user to interact with the system is to be on-site and walk up to a physical keypad, at which point they only have X tries to enter the correct numeric password.

We now wish to introduce remote mobile device access to the system by means of an integral HTTPS server and REST API. Because the system is a very constrained, bare-metal embedded platform, implementing a HTTPS server has been possible (and is now achieved), but I believe that accommodating a token-based scheme such as OAuth will be too difficult at this time, and therefore I wish to rely on TLS-encrypted Basic Authentication.

To comply with standards, remote users shall need to provide a password each time they use the phone app. Product management are inevitably going to stipulate that existing legacy user name strings and passwords are used to authenticate a user remotely via HTTPS REST (in other words, when they use the phone app), but clearly the existing short numeric passwords could be brute-forced easily, and I suspect that trying to implement a lock-out mechanism over HTTPS could be difficult and troublesome. Changing the existing system to use longer, more complex passwords isn't an option because the existing legacy system won't support them. Therefore I conclude that each user is going to need a secondary, higher entropy password for the purpose of remote access, alongside their legacy numeric password. I suspect that product management however aren't going to like the fact that the user now has to memorise and use a separate remote-access password.

The scheme I have thought of as a way around this is as follows:

User initially sets up their app to work with the hardware device. The hardware device provides the user (via its LCD) with a long, high-entropy key. The user enters that long key into their mobile app.
The app internally stores that key permanently, associated with the user's short numeric password.
Each time the user wants to use the app, they enter their numeric password. If the app has a key stored internally for that password, then it is used within the Basic Authorization header (possibly appended to the legacy password) to make HTTPS API calls to the hardware.

This way, there is a high-entropy password for the purpose of remote access, reducing the risk of Basic Auth brute-force. The short legacy password is now just used for the app to retrieve the HTTPS password from local storage. In some sense, I suppose this is like pre-sharing a 'salt' via a separate communication channel (which in this case would be the user reading the key from the hardware LCD). It achieves the end goal of giving the user the impression that they're accessing the system (through the app) by means of their regular numeric password.

The one flaw I see with this is that it relies on the mobile device storing the remote access key. How much of a vulnerability that presents is an unknown to me at this time. What I'm thinking is that, if the Basic Authentication process requires a concatenation of both the remote key (permanently stored) and short numeric password (entered by user each time, never stored) then it means that whatever is stored permanently on the device isn't sufficient for an attacker to gain access without further work.

With my constraints considered, are there any flaws or opportunities for improvement with what I have proposed?

Your solution sounds good, the vulnerability being as you mentioned the  local storage. Since the long password is "salted" with the short PIN you are still prone to attacks should the long password be known.

A way to avoid that is to use a client TLS certificate which will be presented at the server's request. This has the advantage of not being able to retrieve the stored certificate (without some effort) and the whole certificate security  zoo (notably revocation).


How secure are Windows Event Logs? Just doing some reading surrounding analysing intrusions, I’ve read that Windows Event Logs can be modified by an attacker to cover their tracks, how accurate is this and what are the alternative for a systems analyst?

For this question, I am going to assume that the windows event service is running on the same machine that is being attacked.

Yes, an attacker could tamper with audit logs to hide their tracks if they gained control of the machine.

Typically, this is mitigated by forwarding logs to a centralised logging service. This has two benefits:

It makes log tampering much more difficult, and;
Events from across the network and be correlated and queried.

If you have a good logging and monitoring strategy in place, this should allow you to detect, respond and recover much more quickly, limiting the severity of the security incident.

Strong access management can also help to reduce the risk of an unauthorised individual modifying logs. Write permissions should be limited, and manual changes to the logs should generate security alerts.


Windows 64-bit Reverse TCP Shell not working I am sending shellcode to a 64-bit binary running on a Windows machine. This binary, copies the shellcode to an executable region of memory and executes it.

I am generating the shellcode using msfvenom and I chose the payload: windows/x64/shell_reverse_tcp

On the local machine, I am listening on port 3004 with netcat.

When I send the shellcode, on the listener side, I get the command prompt momentarily and then connection is closed immediately as shown below:

listening on [any] 3004 ...
connect to [192.168.2.10] from (UNKNOWN) [192.168.2.20] 42485
Microsoft Windows [Version 10.0.17134.112]
(c) 2018 Microsoft Corporation. All rights reserved.

C:\WINDOWS\system32>

C:\Users\user\Documents\netcat-win32-1.11>

It closes the connection so quickly that I don't get a chance to type in a command.

Note: I do not have access to the server lab environment where the binary is running. All I know is that there is some security solution running on that machine which is preventing this. However, I know the details of the binary and that it takes a shellcode, allocates a new memory, copies it there and executes it.

So, what are my options for bypassing security solutions in this case?

There is port blocking issue here because I am able to get the reverse shell through any port. The issue is that the connection is closed immediately. And it's not a network issue, there is some security solution running on the server side. It's a lab environment and so I know it.
Is there a way to configure nmap to send a list of commands as soon as it receives response from the server?

Thanks

Usually to get reverse shells working the first ports I use are 80 or 443 because even with firewalling set on victim machine these ports usually works. The reason is obvious, that ports are used to surf websites on internet and even on restricted configurations they may be opened. If they are not open you should check for open ports. To do this let's suppose a scenario:

If you are trying to get a reverse shell is because you have some kind of RCE. If you have elevated privileges then you can check the firewall configuration (using iptables on Linux or netsh commands on Windows) and you can open any needed port.

Even if you don't have elevated privileges, you can try to read the firewall configuration to see if there are any ports open on outbound connections. For windows you can check this using commands like this: netsh advfirewall firewall show rule dir=out name=all status=enabled. That will show all outbound rules and then you can try to search for an open port.

If you have a very weird or strange restricted access and you are not able to check the firewall configuration, you still can perform "bruteforce" to check if any port is open for outbound connections. You can first prepare your attacker machine listening in a lot of ports: for j in {1..1000}; do nc -lvnp $j & done and then you can perform a loop on the victim machine trying to connect to your attacker machine. If the victim machine is Linux you can a bash loop using netcat. If is windows it depends on the available software (maybe you have netcat for windows, or openssl or any other tool) and you can perform a batch loop trying to connect to your machine. Then you can check if any port was successfully connected launching a netstat command on your local machine and filtering to see only ESTABLISHED connections, but as I said this is only for very weird environments and is a desperated way to find an outbound open port.

Hope it helps.

EDIT

How are you listening on netcat? do nc -lnvp <port> to avoid dns hostname resolution (the -n parameter) because on your case it seems there is some kind of problem with that.

EDIT2

After checking your comments and your edit on the question, it seems as you said like a security solution is blocking the connection once established. It's not related to firewall stuff. Maybe you can try to encode your payload in order to evade that (maybe is an antivirus blocking it once executed). For that you can try shellter or unicorn instead of using msfvenom. Shellter works well on linux using wine. That solutions are encoding the payloads are very good to evade AVs. Give them a try!


Forensics copy, dcfldd dcfldd is often recommended in forensics to duplicate hard drives. One of the reasons dcfldd is preferred over dd is the on-the-fly hashing feature.

Q: can I really rely on this feature to ensure the integrity of my copy since the hashing is performed on data in memory and not the data written on disk?

If you create and verify the hash, it will detect errors that occurred on the write option. As you point out, read errors can't be detected as they will have occurred before the hash.

According to the ShoeStringForensics blog, you can verify the copy with:

dcfldd if=/dev/sdb1 vf=/media/disk/test_image.dd verifylog=/media/disk/verifylog.txt

You should redo the copy if the hash check fails.


Secure communication between peers with ANON ciphers and password authentication Using ANON ciphers (No certificates required/used) while establishing connection and later using the username/password for authentication considered secure communication?

Are there any flaws in it, like 'Man In The Middle' (MITM) attacks possible?

A large portion of the value of SSL/TLS is the validation of the authenticity of the application you are communicating with.  Yes, a MITM attack is possible in the scenario you describe.  See this other SE answer for more information.


TLS 1.2. Handshake: Where do Client and Server negotiate how the master key is built from randoms and pre? I am currently trying to solve an exercise where I should look at a TLS 1.2 handshake trace while having access to pre and both randoms (server random and client random).

In order to decrypt application data, I need to rebuild the master key.

But I am struggling with finding the section where it is negotiated how this master key is actually built from pre and randoms.

How does TLS 1.2 handle that? Is there maybe a default handling?

At the end, I didn't had to rebuild it manually. I used wireshark and its automatic decryption tools to build the master key and extract the desired information.


Help! My home PC has been infected by a virus! What do I do now? This is an attempt to ask a canonical question as discussed in this old meta post. The goal is to create something helpful that can be used as a duplicate when non experts ask about virus infections.

Let's say that I have determined beyond doubt that my home PC is infected by a virus. If necessary, you can assume that my computer runs Windows. Answers aimed at the non-technical reader are encouraged.

What do I do now? How do I get rid of the virus?
Do I really need to do a full reinstall? Can't I just run a couple of anti-virus programs, delete some registry keys, and call it a day?
I really don't have time to deal with this right now. Is it dangerous to keep using the computer while it is infected?
I don't have backups of my family photos or my master thesis from before the infection occurred. Is it safe to restore backups made after the infection occurred?
Do I need to worry about peripherals getting infected? Do I need to do anything about my router or other devices on my home network?

What do I do now? How do I get rid of the virus?

The best option is what is referred to as "nuke it from orbit."  The reference is from Aliens:

The idea behind this is that you wipe your hard drive and reinstall your OS.  Before you do this, you should make sure you have the following:

A way to boot your computer off installation media. This can be in the form of the Install CD that came with your computer, or a DVD you burnt from an ISO file (Windows can be downloaded legally here). Some computers do not have CD-ROM drives anymore.  Microsoft provides a tool to convert their ISO files to bootable thumb drives. Do not create the install media on the infected computer.
Your Original Windows License Key. This can either be on a sticker on the side of your computer or you can recover it from your computer a program like The Magical Jelly Bean Keyfinder (which might contain malware, but it really doesn't matter because you are wiping it all after you get the key anyway). Or an official tool supplied with Windows called slmgr.vbs.
Drivers. If you don't have a second computer, you are really going to want to have at the minimum video drivers & network card drivers.  Everything else can be obtained online after you reinstall.
Any files you want to save.  You can back them up to a thumb drive for now, and scan them before putting them on your freshly installed machine (see below).

Do I really need to do a full reinstall? Can't I just run a couple of virus programs, delete some registry keys, and call it a day?

In theory, it is not always necessary to fully reinstall. In some cases you can clean the virus off the hard drive without a full reinstall. However, in practice it's very hard to know that you have gotten it all, and if you have one virus it is likely you have more. You might succeed in removing the one that causes symptoms (such as ugly ad popups), but the rootkit stealing your password and credit card numbers might go unnoticed.
The only way to kill everything is to wipe the hard drive, so your best option is always to nuke it from orbit. It's the only way to be sure.

I really don't have time to deal with this right now.  Is it dangerous to keep using the computer while it is infected?

You may not have time for it right now, but you really don't have time for your email getting hacked and your identity being stolen. It's best to take the time to fix it now and fix it right before the problem gets worse.
While your computer is infected all your keystrokes might be recorded, your files stolen, it might even be used as a part of a botnet attacking other computers. You do not want this to be going on for longer than necessary.
If you really don't have time to deal with it right now, power down the computer and use another one until you have time to fix it. (Be careful with file transfers from the infected to the uninfected computer, though, so you do not contaminate it.)

I don't have backups of my family photos or my master thesis from before the infection occurred.  Is it safe to restore backups made after the infection occurred?

Any backups made after the virus infection occured could potentially be infected. A lot of the times they are not, but they could be. Since it is very hard to pinpoint exactly when the infection occured (it may be before you started to notice symptoms) this applies to all backups.
Also, Windows restore points can be corrupted by a virus.  It is better to archive copies of your personal files on external or cloud storage.
If you are restoring them from external or cloud storage on a computer that has already been nuked from orbit make sure you scan all the files you are restoring before you open them. Executable files (such as .exe) can contain viruses, and so can Office documents. However, picture and movie files are likely safe in most cases.

Do I need to worry about peripherals getting infected? Do I need to do anything about my router or other devices on my home network?

Peripherals can be infected.  Once you have re-installed your OS you should copy all the files off your thumb drive, scan them with antivirus, format the thumb drive, and restore the files to the thumb drive as needed.  Most routers will be fine, however, it is possible for DNS settings to be compromised either through a weak password or malicious use of UPnP.  This can easily be resolved by resetting the router to factory defaults.  You may also want to configure your DNS settings to either google dns or OpenDNS. If you have some type of network attached storage, you should do a full scan of it with antivirus before using any of the files on it.
See Also: Help! My information has been stolen! What do I do now?
THIS IS WORKING DRAFT FEEL FREE TO WIKI/EDIT AS NEEDED


Is there a list of known deprecated/unsafe certificate authorities? Is there a list of known deprecated/unsafe certificate authorities (CAs)?

For example:

TurkTrust
DigiNotar

Are there other "trusted" CAs that should not be or are not trusted (by browsers anymore) and why? Or better is there a list with such CAs?

Since anyone could stand up a new CA that wouldn't be trusted, you may be better off just taking the union (or perhaps intersection) of the CAs trusted by the major browser vendors.

That said, you can probably get the information you asked for from a combination of the following sources:

https://aka.ms/rootupdates
https://blog.mozilla.org/security/category/ca-program/
https://www.chromium.org/Home/chromium-security/root-ca-policy
https://support.apple.com/en-us/HT207177
Custom search of Mozilla's bug database


Can attackers leverage a sites SSL to "hide" attacks from a IPS? I am running an IDS on the outside of my firewall (I know not ideal) and an IDS on the inside of my LAN running the same detection algorithms and definitions. My website auto redirects all HTTP requests to HTTPS. My IDS frequently detects nmap scans, OpenVAS scanning activity, GNU Bash Environment Variable Code Injection attempts, etc on the inside of my LAN that is not seen or blocked by my IPS on the outside of my network. I assume this is because these attacks come in encrypted using my own SSL and since my IPS on the outside does not host my SSL certs it cannot see these attacks. The traffic is decrypted on my LAN by a load balancer that hosts the SSLs prior to passing the traffic to IIS Servers and this is where the IDS detects the attacks.

My only conclusion based on the the lack of detection of these attacks are that the packets are entering our network encrypted with our own SSL certs and is therefore "invisible" to the IPS.

Is it possible, or maybe even common, for these exploit attempts to use a targets own SSL certificates to avoid detection?

Yes this is a known issue, you can also route all sorts of attacks to servers via a variety of encrypted protocols using SSL/TLS client-side proxies, or other client side services just to make attacks easier. This does create a situation where on some networks attacks against an http listener would not be effective (detected/blocked by a security control) but attacking the equivalent https listener would be very effective because it would not be detected/blocked. In some cases you'll also bypass other security controls such as the firewall's inspection capabilities.

Similarly attackers may have more success attacking things like SSH daemons, VPN's, or SSL/TLS encrypted services like mail servers for the same reason.

Note: you can also add decryption capabilities to your IDS/IPS, or other device, or simply change it's architectural placement to deal with this issue. some devices will even terminate the SSL session, inspect it then create a new ssl session to the server. There are many ways to work around this issue as a defender and yes you've discovered the problem first-hand.


How does disk encryption mounting work with large disk and low RAM? For example with Truecrypt or bitlocker, when my hard disk contains 500 GB encrypted data and 256 MB Free RAM, how is the data decrypted/disk mounted when I turn on my computer?

If the entire disk is encrypted with the same decryption key, does it require the same amount of RAM to process the data? Or is encryption applied on small blocks and decryption applied by just decrypting those blocks?

In block ciphers (e.g. AES), the data is split into small blocks, and each block of data is processed in sequence. This allows a huge amount of data to be encrypted or decrypted without consuming much RAM.

Load one block of plaintext into memory.
Encrypt it.
Save it.
Move to the next block and start again.

And to decrypt:

Load one block of ciphertext into memory.
Decrypt it.
Use / save it.
Move to the next block and start again.

In this scheme, it is easy to encrypt or decrypt blocks at random. Unfortunately, this is insecure.

Block ciphers run in a particular mode of operation. The simplest mode (the one I just described) is called ECB, or Electronic Code Book. Each block is processed completely independantly, allowing for each block to be decrypted independantly, as we saw above. Unfortunately, this leads to some serious problems with security, where patterns in the plaintext show up in the ciphertext.

The first image is plaintext, the second is encrypted with a block cipher in ECB mode:

Other modes solve this problem by chaining blocks together using certain operations. This causes the patterns to be dispersed:

Most modes of operation (e.g. Cipher-Block Chaining) will require the previous block to remain in memory. However, since a normal block size is only 32 bytes (256 bits) it doesn't require much memory at all to keep it. However, it does mean that every block up until the required block has to be processed first. This is obviously not practical for disk encryption, because to read disk sector 100,001, we'd have to read and decrypt all 100,000 previous blocks.

TrueCrypt uses XTS, a special mode of operation designed specifically for storage devices. This allows blocks (or short sequences of them) to be decrypted entirely separately, without losing the security that non-ECB modes such as CBC provide. This means that you can easily decrypt files on the disk without having to decrypt everything else, whilst avoiding the security problems that ECB has.


What is the proper way to understand Access Complexity in CVSS I have read Access Complexity from NVD(https://nvd.nist.gov/CVSS/v2-calculator),
[Access Complexity]

  This metric measures the complexity of the attack required to exploit
  the vulnerability once an attacker has gained access to the target
  system.

  Medium (M) : Some information must be gathered before a successful
  attack can be launched. Low (L): The attack can be performed manually
  and requires little skill or additional information gathering.

I have a question: if one vulnerability is hard to be discovered,and the attacker need collect certain information first, but the vulnerability is easy to be exploited. If the Access Complexity metric is "Low" in this example,is it reasonable?

Access Complexity is a very overloaded and subjective metric in CVSS v2. When it's applied, it's impossible to tell if it's being used for user interaction from social engineering, from a race condition, uncommon configuration, attacker starting privileges, or anything else. (https://www.first.org/cvss)

Are you aware of CVSS version 3 that came out last year?

In CVSS version 3, it is now renamed as "Attack Complexity" and only have two metric values- Low and High.
Now, it’s much easier to choose between two possible values. It should be noted that any 'user interaction' should not be considered while rating 'Attack Complexity' parameter. CVSS has a new parameter called 'User Interaction' to incorporate this.

Low  (AC) : If the attacker can exploit any time (Reflected XSS)

High (AC) : Some conditions beyond attacker's control exists. (say Poodle attack which requires MITM attack)


Certificate Pinning Best Practice or Alternative I'm looking for the "best practice" to use in Certificate Pinning or an Alternative.
Scenario:  I have a native mobile app and I have pinned the certificate so that the app can validate against my server.
Problem: The problem comes in 1 year when the certificate expires where I need to have all my app users update their app with the new certificate version OR the app will simply not work.
Desired Outcome:  I would like to update the certificate pinned in the mobile app without having to have the users update to a different version of the app.

You have a couple of options on what to pin. Depending on which one you chose offers you different trade-offs. Here are some typical pins:
Pin the certificate itself
Yes, you will need to change it when the certificate expires. Most secure but quickly causes availability issues if users don't update often enough.
Pin the public key of the certificate
This allows you to keep the pin unchanged as long as your public key stays the same. You use the same public-key with a new certificate. While it is theoretically a bit less secure, I would put it on the same security level as the previous. If you lose the private key, both setups need app updates.
Pin an intermediate certificate
Here you have two choices again, pin the cert itself or the public key. These certificates have more extended validity periods considerably. You expose yourself a bit more, as the CA can create new certificates that your app would trust.
Pin the root certificate
Again, two options: cert or public key pin. This binds you to a CA, which still increases security; an attacker can't just use any trusted root to fool your app. While this is the least secure of the options, I think it is still a lot better than not pinning at all.
One thing to consider is always to have multiple pins! If you pin your certificate, make sure to have at least two and pin both, so you can immediately jump to the other if you lose one. If you pin something else on the trust chain, be sure to pin all of the CA's possible certificates.
In general, I would go for pinning the CA's root certificate's public key. This balances security and maintenance. Consider your threat model and chose accordingly.
You can find a bit more information about this at OWASP's Certificate and Public Key Pinning