How can I verify if a website revoked its old SSL certificate keys? Through reading from multiple sources and watching Security Now's How the Heartbleeds, I have come to the understanding that the following procedure is recommended to be safe from the Heartbleed vulnerability (assuming that the user's browser reacts correctly to revoked TLS certificates, which I know may not be the case for all browsers right now, but let's leave this issue aside for the moment):

Upgrade to a patched version of openssl
Regenerate the TLS certificate (rekey)
Revoke the previous certificate

Doing the previous steps would:

Prevent exploitation of the Heartbleed vulnerability to steal the new key (because of 1. and 2.)
Protect users from Man in the Middle attacks using a stolen key (because of 3.)

Now, I know that there are multiple tools to see if a website is currently unsafe (1. did not update) or potentially vulnerable (2. did not rekey), but how can I know if a website revoked its previous certificates?

I believe I could check for a specific key (if it is known) using tools (which I assume use OCSP or CRLs), but is there a way to access previous keys of a website?

It is purely out of curiosity, but I would like to verify when a website says "we are safe now" that they really did revoke their certificates as well as update openssl and regenerate the keys.

Thank you very much for your precious time and pardon the potential mistakes caused by my lack of knowledge in the field of information security.

I find the question useful, because it is actually hard to find out if a certificate got revoked the right way.

If you know who issued the original certificate you can download the CRLs (which contains only the serial numbers and the date of revocation, not the revoked certificate itself). If not you are out of luck.
If you know the serial number of the old certificate you can check if it is in the CRL list. If you don't know the original serial number you have no chance to check the revocation.
If you found out that the certificate got revoked you still don't know if the owner is just reusing its old and probably compromised public/private key pair again with the new certificate. Without having the old certificate you will never know.

So the best thing would be if the owner would make the old certificate (but not the private key) accessible, so that others could verify the correctness of the verification.

At the end it shows again, that the current PKI architecture and not only the TLS implementations are broken. Did you ever wonder why new browser versions got shipped on all the major CA problems (DigiNotar + Comodo 2011, IGC/A 2013)? Because the revocation as originally designed just does not work correctly.


How to use HTTPS for servers whose IP and domain name change, potentially frequently? We have devices (think "Internet of Things") that have a HTTP server installed. Those devices can change their IP and domain name quite frequently (or have no domain name at all). They have a GUID though.

The clients communicating with this HTTP server are not all under our control - they might be common browsers.

Is there a way to use HTTPS in this situation, without forcing the user to either

Accept an invalid certificate
Add our own CA to their trust store
Do something else that seems fishy?

Does the answer change if we have control over the client (an app)?

In the past this was solved by using a server in the internet, to whom both client and device connected, and which forwarded messages.

The certificate is used to validate that a client is talking to the expected endpoint and not to some man-in-the-middle. If IP address and hostname change frequently this means that they cannot be used for identification.

  ... not all under our control - they might be common browsers.

Browsers expect to have a constant hostname, even for certificates were an explicit exception was made. Thus common browsers can not be used if the hostname changes frequently.

  Does the answer change if we have control over the client (an app)?

In this case you could use certificate/public key pinning, that is your application does not expect a certificate signed by any trusted CA where the certificate matches the hostname but instead it expects a specific certificate or at least a specific public key. Of course this expectation must be hard-coded into the application.

Another option would be to work around the problem of changing hostnames by providing your own DNS service and provide constant hostnames within your own domain (e.g. foobar.customer.example.com). But this would require that each device announces any hostname changes to your DNS server so that the appropriate CNAME alias could be setup and that the clients would need to have an internet connection in order to connect to the device even if the device is in the same local network.


Why is TLS_FALLBACK_SCSV secure against a MITM attack? It is recommended, to mitigate POODLE, if SSLv3 cannot be disabled entirely, to make use of TLS_FALLBACK_SCSV, a signaling cipher suite value that indicates that fallback has occurred. The draft standard for it says:

  If TLS_FALLBACK_SCSV appears in ClientHello.cipher_suites and the
        highest protocol version supported by the server is higher than
        the version indicated in ClientHello.client_version, the server
        MUST respond with an inappropriate_fallback alert.

The idea, as I understand it, is that if the client has tried and failed to negotiate a connection with, say, TLS 1.2 (possibly because a MITM has forced this situation in a protocol downgrade attack), the server will be able to detect the situation because this signaling value will be present in the list of cipher suites.

I am not very familiar with TLS negotiation, and I do not understand why it would not simply be possible for the attacker to also manipulate the list of cipher suites to remove this signaling value?

For example, the client attempts to connect to the server with TLS 1.1, but Mallory the MITM intercepts and fakes a failure. And does so again when the client attempts to connect with TLS 1.0. When the client attempts to connect with SSL 3.0, Mallory strips TLS_FALLBACK_SCSV from the cipher suites, and passes the request on to the server, and then passes the server's response back, allowing the connection to be negotiated without the server ever seeing the FALLBACK indicator?

What features of TLS prevent such an attack? Is the list of cipher suites encrypted somehow, even before the session has been negotiated?

At the end of the handshake, Finished messages are exchanged, under the protection of the newly negotiated algorithms and keys; in particular, the contents of these messages are protected by a MAC. The contents of the Finished messages are a hash of all preceding handshake messages. Any external manipulation of the ClientHello message as it transits from client to server will be detected at that point: the client and the server won't work over the exact same ClientHello contents, thus won't obtain the same hash value for the Finished messages.

This protects the handshake against alteration as long as whatever alterations the attacker performs don't allow him to immediately break the whole crypto layer. In the case of the Poodle, even if the attacker succeeds in forcing SSL 3.0 usage, he cannot destroy the crypto right away, and thus cannot "fix" the Finished messages.


What FOSS software do you like to use to build intrusion detection stacks? Start-ups and organizations with limited budgets that are security conscious are often encouraged to deploy intrusion detection stacks.  Given that prevention will always fail, intrusion detection stacks are often vital to learn why defenses failed.

I am a fan of the following intrusion stack covering the app layer, system layer, and network layer:

  system:  OSSEC
  application:  ModSecurity
  network:  FlowMatrix  (i cheated, this one is not FOSS, but it's free!)

What are your favorite intrusion (FOSS or free) stacks?


Is an HMAC hash of plaintext data secure enough to use as a lookup index for encrypted data I'm working on an app that will download files from external servers over https and store them on disk in a relatively secure way. Specifically, using a cryptographically unique IV, an AES256 cipher block, CTR block mode, and an HMAC hash of the encrypted data and IV.

One of the requirements of this project is that no duplicate files should be stored. Given the need for a unique IV to securely store the files, I can't simply use a hash of the encrypted file to see if the download is a duplicate. A sha256 or sha512 of the plaintext content isn't sufficient either because the client may download and store single character files making their contents easily guessed, potentially opening the system up to known plaintext attack vectors.

So I was wondering if it would be considered reasonably secure to store HMAC hashes of the plaintext, using an Argon2ID derived key as the HMAC signing key?

These hashes would be stored in a key/value database, and used as a lookup key to see if a downloaded file is one that we already have. The Argon2ID key will never be stored.

Yes. You can do this. It is secure. One application is ssn encryption. If you simply hash an ssn, it’s trivial to loop through all ssn, hash them all, and create a map. But if you use hmac with a well protected secret, then you can hmac(secret,query) and use that to look up data.

You do need to protect the secret.


How to make VPS more secure with UFW? I have 3 VPS based on Ubuntu 18.04 server OS and would like to open particular ports on each servers.
The ports, that I would like to open are:

Then let's take a look on the environment:

As you can see on the image, every server has a public IP address.

Now, I would like configure the UFW firewall, so that only those 3 IP addresses are allowed to communicate through the ports, that are listed above.
For example, the server with the IP 120.88.41.175 has the permission to access the server with the IP 120.88.41.176 through the ports, that I've listed above. The access should be bidirectional.

But the server with the IP address 120.88.42.175 has no permission to access the server with IP address 120.88.41.176.

I know, that UFW offers settings to allow particular IP to access particular port on the server, for example:

sudo ufw allow from 120.88.41.175 to any port 6443* proto tcp

Now the server 120.88.41.175 has access to the server 120.88.41.176 through port 6443*.

Then a bad person comes and try to access the server 120.88.41.176 through the port 64435 and he/she identifies themself
as 120.88.41.176. Now he/she can do bad stuff on the server.

The question is, how can I protect my VPS from such as violation but at the same time, keep the open the ports?
I need to open the ports because I am going to build a kubernetes cluster.

So, to start, let's look at the architecture. Many VPS providers aren't good about this, but if you can communicate between your VPS' on an internal network using private IPs, that's preferable. Digital Ocean will let you do private networking and accomplish a lot of the inter-connectivity without traversing the public Internet. If you can do this, you'll remove a ton of attack surface by limiting potential MitM attacks and making IP spoofing untenable (or at least less-tenable) from the Internet.

Next you would want to avoid having to expose the API server to the public Internet (or at least I would). The kubernetes API server is fairly robust and uses reasonable authentication, but it presents a large attack surface and potentially large damage if it's compromised. So I'd recommend having a Bastion Host or VPN server that allows you to connect into the kubernetes environment where you can administer your cluster. Just don't store any authentication mechanisms on this bastion hosts, make it a dumb jump-box in  case it's compromised.

To avoid exposing all of the nodeport services, you can use a Load Balancer, if your VPS provider has one, probably you should use that, otherwise a dedicated nginx box would be best. However, for tighter integration, you might expose 443 on each of your worker nodes and use the nginx-ingress controller on the cluster itself, this way you can use a lot of the built-in integrations, but still control what services are externally exposed.

Once you have those two things taken care of, you could probably get away with just allowing all traffic between your kubernetes nodes within the cluster. But it would be better to batten the hatches as it were.

Let's define the servers/VPS into the following groups

Etcd nodes
API Servers
Control plane (all of the Etc nodes, schedulers, controllers, api servers)
Worker nodes
Bastion Host
Load Balancer

you would want to implement the following rules using UFW and (if it exists) your VPS' security groups/cloud firewalls/etc. These rules assume a stateful firewall like UFW or AWS Security Groups. If you're using AWS Security groups, you can have named security groups for each of the above groups and have them reference each other and not specify IP addresses at all. Using UFW, you will have to list IP addresses.

Control Plane and Bastion Host -> API servers over TCP/6443
Etcd and API Servers -> Etcd Nodes over TCP/2379-2380
Load Balancer and Worker nodes and Control Plane -> Worker nodes over TCP/30000-32767
Control Plane -> Control Plane and Worker nodes over TCP/10250
Control Plane -> Control Plane over TCP/10251-10252

This could be broken down further, but I think this is a reasonable configuration. I don't think the Control Plane needs access to the nodeport nodes, I don't think the etcd cluster needs access to the kubelet, and so on. Proceed down the rabbit hole as far as you like. To lighten up the security posture you can expose the nodeports and the API server to the world, just make sure you understand the ramifications of doing so.

Attacks against this architecture

As you mention, if your cluster is talking over the public Internet, anyone can identify themself as a whitelisted IP address. Suppose an attacker sends a request to Etcd at 120.88.41.177 and says that their IP is 120.88.41.176, but their real IP is 120.88.41.175. The request will bypass UFW just fine, but the server will also send the reply to 120.88.41.176 and not to the attacker. Unless the attacker can intercept the traffic, the attacker never can see any of the replies.

Also, for this to work, the IP addresses of your servers would have to be known to the attacker (which may or may not be a tall order).

Next, the cluster-level communications (Between the Kubelets, API servers, Etcd cluster, controllers, and schedulers) all run over HTTPS by default, using client-side TLS authentication. (EDIT It looks like Etcd with authentication is not support by default as of k8s 1.17, so limiting network access to Etcd from ONLY the API server(s) is very important). So in order for the attacker to communicate with anything within your cluster, they also have to compromise your CA or a client key somewhere in your infrastructure. At which point, if an attacker compromises a client key, they probably have some access to one of your nodes and the network security is moot.

This is why I would suggest some variation of the above suggestions for your network, and then focus your efforts on good RBAC controls to limit what actions each pod can do, and limit what actions each node can do. Or add some network policies within kubernetes to limit the access of the pods. At the host/VPS level, the networking is pretty straightforward, the API server has to be reachable by all of your nodes, so you can't really protect against a compromised node/pod using UFW.


Is protecting a parent folder secure enough to protect files within that folder? So this topic came up during a hardening exercise on Unix/Linux machines where a parent folder was marked with chmod 740 but files within that folder were marked chmod 644, and the argument went that we don't need to change permissions of the files within the protected folder because users can't cd to the directory to see the files within that directory.  I wasn't convinced this meant they were secure.  In what ways could those files be exposed to a user that wasn't supposed to have access?

There is an excellent answer for this question on SE Unix & Linux.

In short, and to quote the answer:

  The precise rule is: you can traverse a directory if and only if you
  have execute permission on it.


How to prevent SSH host impersonation attacks? I have an SSH server, where users can login to with their username and password. I want to prevent attacks that try to steal the user's passwords.
Is there a way to prevent an impersonation attack on my SSH server?
The attack scenario:

User connects to my SSH server for the first time or from a new PC (from public/compromised network).
An attacker in the network impersonates my SSH server.
The attacker sends his public key instead of the real server key to the user.
The user accepts the key, assuming it is the real key.
The user sends the attacker his password in the authentication stage.

I know that my SSH server can use a certificate, but the attacker can still do the same attack since users don't know that they aren't supposed to get a key and they are used to accept the key in the first connection.
So I'm wondering what method to use to prevent the attack.

I have SSH server, where users can login to with their username and password

Here's the obvious way to fix the problem. Don't use passwords. Instead of letting users choose a password (or generating a password for them) let them upload a public key (or generate a key pair for them). With key authentication, an adversary who can intercept communications can impersonate the server to the client, but cannot obtain the credentials to impersonate the client to the server.
To completely prevent the risk of impersonation, you can provide the server's public key out of band and instruct users to add it to their known hosts file. Using certificates for this makes management easier if you control multiple servers, but it doesn't simplify the initial client provisioning.


Can hackers go undetectable with a valid certificate with SSLSplit Most of us might know about the program SSLSplit (not to be confused with SSLStrip) that performs a man-in-the-middle attack by generating a certificate and making the user being MITM'd use that certificate so that the traffic can be sniffed.

My question is, rather than having SSLSplit generate the fake certificates, could they use one they bought which has been signed by a certificate authority and give that to the user being MITM'd to avoid the insecure connection error that you would normally get?

TL;TR: having a certificate signed by a trusted CA is not enough if certificate checking is done right.

Only if all of the following points are true about the certificate sent by sslstrip then transparent man in the middle attacks are possible:

The certificate must be signed by a trusted CA: this is easily possible.
The certificates subject must match the name in the URL: you usually do not get a certificate with a matching subject for a domain you don't control from a publicly trusted CA.
The attacked site does not employ certificate or public key pinning, i.e. builtin pinning like done for some important domains by the browsers or explicit pinning using the HPKP header.

Note that these points rely on the client doing a proper job with certificate validation. But older versions of PHP, Python, Ruby... don't do it and developers often switch off validation because it is annoying during testing or because they rather use self-signed certificates (which is fine if you have an explicit pinning in your application).


Is it safe to share msinfo32? Is it safe to share your msinfo32 export with the Internet?
Does it contain any sensitive data like PII?

It depends a whole lot on the context, and what you are trying to protect yourself from.

What does this information contain?

The information in msinfo32 is structured as a list of key-value pairs, which are themselves part of a tree.

For example, the leaf "System Summary" contains information like OS Name, System Manufacturer, User Name, Time Zone, Available Memory, etc.

Why would anyone want this information anyways?

There are plenty of legitimate reasons to ask a person to disclose this information. The most obvious would be tech support. A user complains that an application always crashes, and tech support asks them to send them the information from msinfo32.

This might help them find common ground between you and other users, who also experience the same problem. For instance, let's say all the users who reported this problem happen to have the exact same build of Windows 10, on the same CPU.

While it doesn't exactly solve the problem, it allows the developers to more easily reproduce the problem, and thus aid them in solving it.

So can I share this info freely?

This depends. If you own the machine, then you are free to do so. If it's a good idea is another question (see below). If your machine belongs to your employer, then there may be policies in place on the disclosure of internal information.

Please check with your employer if you are allowed to disclose this information, and to whom for what reason.

Why would it not be a good idea to post this information publicly?

While it doesn't directly contain personally identifiable information, it may give someone interested in you some information that you might not want to share.

For example, your username might be based on your real name, or parts thereof. If you post the information under a pseudonym, an attacker who knows you in real life may be able to connect this pseudonym to your real identity. For example, the information indicates you have a laptop by "FooBar", model "X-Ample 9001". If the attacker knows you own the exact same laptop, it may be an indicator.

Is this far-fetched? Yes, absolutely. It's probably not something you should worry about.

Another possible threat could be installed software and versions thereof. If an attacker knows you have some software with a known vulnerability installed, then you immediately become a more interesting target, as an attacker can assume that there is some way they can exploit you.

So, what now? Can I share it or not?

I would say it depends on who you share it with, and why. If some tech support you contacted asks for this information, they probably have a legitimate reason for it and you are free to do so.

If a random person asks you for this info, but can't give you a specific reason why, then it's best not to do so.


Can WhatsApp, Signal or Telegram be hacked through a SIM SWAP attack? In Cuba the telecoms/ISP monopoly, Etecsa, works with the political police to spy on dissidents, journalists and others.
A common attack in Cuba is therefore SIM Swapping which is easy for them. It is also effective in order to eavesdrop on phone conversations and SMS.
Would the SIM Swap enable the attacker to also hack WhatsApp, Signal or Telegram and gain access to these messages or calls?
If so, are there any measures that can be taken to prevent the attacker from accessing the secure messaging apps via a SIM Swap attack?

I can only tell about WhatsApp because I do not use or specifically know about the others.
Basically, with a SIM swap attack, an adversary can get future messages intended for the target, but not access the chat history.
With WhatsApp, conversations are protected with a "security code" which enable the safe recognition of participants.
In a SIM swap attack (with a different phone used), the security code for the forged participant would change, so the others would get a notification - given they enabled that, which, unfortunately is not by default.
And it only notifies them once they receive back a message from the victim.
Read the Security Code Change Notification FAQ about it.
Furthermore, you can halt the attack altogether for 7 days if you use two-step authentication on WhatsApp.


What's the purpose of the preflight check on CORS requests? A fellow developer and I were experiencing a weird issue with our application in the past couple of days. Specifically, he's writing the API and I'm writing the web front end.  Since the UI runs from a different port, we have to setup CORS in the application so that the UI could make requests into the API.

I'll not go into great detail but this is the first project where I've had to heavily engage CORS.  Specifically, our problem was related to the UI code sending JSON data as the request body and specifying in the header a content type of application/json.  Since this isn't an acceptable content type within CORS, the preflight rejected the request.

At the time neither of us were aware of preflight requests and I had assumed my fetch(...) calls were modifying my headers and dropping my data.  After finally digging into the mechanics of CORS, we were able to discern that the problem was with the preflight request receiving a response stating that my content-type wasn't accepted.

after we fixed our issue, I couldn't help but wonder what was the purpose of the preflight check.  Specifically, this doesn't benefit to browser/UI.  You should an error when you make a request that isn't accepted by CORS and the response from the server can relay this specifics of why your request isn't needed.  In other words, you could skip a preflight check and just rely on the response from the server to dictate whether the request is correct, and this saves the browser from making two requests for the single call.

Preflight checks also don't benefit the server.  The server should reject any request that doesn't match the CORS requirements, regardless of whether a preflight call has been made or not.

So, what's the point of the preflight?  Why is it proper for the browser to make to calls, instead of one, when the default allowable CORS header properties are different than what's being requested by the client?

In other words, you could skip a preflight check and just rely on the response from the server to dictate whether the request is correct, and this saves the browser from making two requests for the single call.

That would assume that the server is properly validating the request in the first place. The problem is that many servers don't which is the reason CSRF works.

Traditionally it was impossible to do cross-site requests doing JavaScript at all. CORS allows to relax this restriction. But CORS was designed in a way that it will not reduce inadvertently the security. Server side code which simply relied on the fact that XHR could never be done cross-site should not be accidentally become insecure. That's why with all but simple cross-site requests done with JavaScript the browser first checks that the server will explicitly allow a cross-site request by sending a preflight request before doing the real request it.


How likely are Evince, XReader or Adobe Reader with scripts disabled, to be exploited by a malicious file? PDFs are very commonly found on the web, and I carefully either view them on the browsers, or use readers without the capability to run the scripts that may come with them (shitty design choice) like Evince or XReader, or, on Windows, disable the scripts on Adobe Reader.

However, I was wondering whether other sorts of attacks may be possible by exploiting other unpatched vulnerabilities. Since I find it hard to trust the 100% of PDFs you open, what are the best practices to minimize the risk?

The best practise¹ would be to open them on a Virtual Machine (or even in a separate, physical machine that you could easily reimage after each use).

On Qubes OS, the ability to open a PDF on a separate, disposable VM is (mainly) integrated in the system: How Qubes makes handling PDFs way safer

They also include an option to create a trusted PDF, whiih basically created an image-based pdf in a separate VM.

The PDF Redact Tools can also be used to create clean, image-based, PDFs. It should as well be run on a separate VM.

¹ Assuming you are going to open them


In what ways can the URL be analyzed to decide whether a page is Phishing or not? In what ways can a URL be analyzed to check whether its a Phishing page or not. Such as using target site's name somewhere in the URL, URL obfuscation, misspellings, etc. Its not possible every time that URL analysis will be able to judge whether a page is a phishing page or not, but can it be used in some cases?

So what are the different ways to analyze URL to detect phishing?

Assuming that the phishing link is sent over email, the following set of details can be verified to identify whether or not they are phishing attempt of not. An algorithm which incorporates the following can detect most such instances.

Contradicting hyperlink

If the text of email shows a URL and the content  is hyperlinked to a different URL, it is very likely a phishing attempt. For example this is a phishing link https://google.com

Trust factor of the domain name

Sometimes attackers might try to confuse users by creating subdomains which sound similar to trusted domains. For example > https://facebook.com.secvibe.com An unsuspecting user who is not aware of the concept of subdomains might think that the above link is from facebook.

Similar sounding domain names

Domain names with slight difference in spelling from the actual domain names.For eg: Facebookd.com

Shortened URLs

Shortened URLs need not always point towards trusted sites. People might use goo.gl or bit.ly to send phishing links.


Is it wise to show the "e-mail has been scanned by XYZ antivirus" in e-mails footer? It is a common practice to append the "antivirus footers" to emails, e.g.:

  Scanned by ClamAV

or

  This email has been scanned by the XYZ Email Security service

There is many opinions about it, some say that it allows potential attacker to choose the way of attack which will avoid/bypass the revealed security mechanism.

The others say it works like a sign "Be aware, we care about our security" which could scare potential intruders.

I would like to collect all pros and cons of both approaches, I believe this kind of topic hasn't been discussed yet.

I don't think it's a good practice to include footers like this in email correspondences. My arguments:

It clutters your email thread, making the actual message stand out less
The info is irrelevant to most recipients
It's probably not wise to expose the anivirus mechanism to the outside if it can be prevented
As has been mentioned by Steffen already, the claim cannot be verified by the recipient anyway
Companies are supposed to have some form of antivirus checks in place anyway; "bragging" about it in email footers shouldn't be necessary.

To sum up, I personally take footers like this as a sign that something's fishy (about the mail or the company). Why would they mention that at all?


Is it reasonable to store encrypted TOTP keys + authentication credentials on a single device (for end-user)? My current security model (at least for passwords) is to store them encrypted at rest and use GPG (in combination with an Yubikey) to perform encryption / decryption. I'm using pass (https://www.passwordstore.org/) to help automate the process for encryption / decryption. These files are stored 0700 and I plan to synchronize them to either iCloud Drive or a proper git repository (at some point). Right now I'm just backing them up to an Ironkey (D20402A). I am using 4096 bit subkeys for GPG encryption / decryption.

TOTP codes however, I still store on my iPhone (using Google Authenticator). I know there are third party solutions like Authy but I'd like to migrate away from my phone if at all possible.

Ideally I'd like to store my TOTP secret keys in a way that can be retrieved (and adequately backed up) from my computer for easier scripting and automation. There are some services like AWS that require an TOTP code alongside my normal authentication credentials which are motivating this.

Would storing these TOTP secrets alongside my passwords (provided both are encrypted) safe enough or just a bad idea? The way I see it there are basically four items necessary for somebody to unlock my keys:

Physical computer (full-disk encryption using APFS) or Ironkey
Physical Yubikey (or the backup, or the master key backup)
Disk or Ironkey decryption password
My Yubikey PIN

There's a tool called https://github.com/tadfisher/pass-otp that I may use for this.

I'm torn on whether this is an acceptable security solution. On one hand, the "second factor" aspect that TOTP brings is subverted by storing all the secrets on a single device.

On the other hand, I am reasonably confident that the device and methods I plan on using around my proposed solution is adequate enough to protect this data. I recognize all of this flies out the window if my machine itself is compromised (but that leaves me screwed in any situation).

Since you mention that you use smartcard features of your Yubikey to store the PGP encryption key necessary to access the pass database, I would say that it is okay to keep TOTP shared secrets in pass alongside other password data. TOTP is a mechanism to ensure 2-factor authentication, so as long as you require the Yubikey to decrypt them, you are still using 2 factors (yubikey = something you have, the PIN = something you know).

There is an important caveat here, though -- there is a lot more application sandboxing happening on modern Android phones than there is on a modern Linux workstation. Anyone who can execute code on your workstation (as your user) will likely be able to grab those TOTP secrets from RAM or by waiting till you insert the yubikey and decrypting them directly once they know the PIN. On the other hand, the storage and memory belonging to a TOTP application on your phone will be generally better isolated from other applications you're using, so it would require a root-level compromise before an attacker can access the secrets stored in a TOTP app.

If that is an acceptable trade-off for you, then you can put those shared TOTP secrets into pass. If not, then you should stick with keeping them on the smartphone.


Username and Password in JSON Iimplemented a REST server to enable JWT Authentication with support to TLS (with a certificate self-signed).

When I send the credentials to my REST server with a plugin of firefox (RESTClient) and view HTTP Headers with another plugin (Live HTTP Headers), I see the credentials in plaintext. What am I wrong ? With SSL enabled, why I see the credentials in plaintext and not encrypted ?

Data will be encrypted while transmitted over the internet, not on either sender or receiver. So in other words:

sender (not-encrypted data) -> transmission (encrypted data) -> receiver (not encrypted data)

If you want your data to be protected even when received at the receiver side, then you will need to apply some encryption scheme before sending them over TLS. Also consider using digest authentication and not plaintext.


Detecting Key Loggers We know that key loggers are the most effective and most annoying means of getting compromised over login id/password on the web or any application....  and your whole privacy is breached.

Is there a way to detect key loggers yourself, instead of relying on an anti-virus solutions for this purpose ? What is the logic behind a key-logger detector...  ? Do I need to write a scipt to look for log files that correspond to key strokes, or is there a better approach than this ?

You could download or write a script such as Neuber's Spy Protector http://neuber.com/taskmanager/index.html which has an option of blocking keyboard monitoring.


Basic nginx securing / restricted access I run a private virtual server on Ubuntu 14.04 and I use Nginx as my http server and/or reverse proxy. I run multiple webapps on this server, most of them are fresh open source projects.

UPDATE :
The server is a VPS that I rent to a hosting company. Setup will be a subdomain per app.

I am wondering what are the various possibilities of securing nginx in a simple environment. As for now this server is only used for dev/private use I would like to achieve the followings :

Use an authenficiation for apps that don't have their own. Otherwise anyone can use it.
Restrict access to certain machines. I know Nginx can deny access based on IP adress, I was wondering if I could achieve this using other variables such as mac adress for example?
Prevent search engines to index what is on my server. I have read that I could use an Apache .htaccess but can I do it with nginx ? What is the difference with robots.txt files ?
How would one isolate webapps ? I was wondering if I could run each apps as separate users in order to harden security. Otherwise (someone tell me if I'm wrong) a security breach in one of them (and that may happen often with young projects) could allow an attacker to have access to all www-data user files. Regarding this thread I don't know if I must investigate in php5-fpm pools or only nginx or both.

Thanks !

UPDATE

Interesting readings about Docker and Sandstorm

I usually set folders to 755 and files to 644. (Some apps recommend 777 on entire folders :0) For a server I prefer to stay on ubuntu for now (easier) despite I had a really great time discovering Arch few months ago. However I've seen this. I should be able to set SE linux.

I always use https. Nginx is only listening on ssl port.
The "problem" is I use a self-signed certificate (maybe not for long)  and I don't know a lot about cyphers so I'll investigate ssl first before I ask some questions. I've just learned this morning that I could use TLS in nginx config ^^

I don't really understand what hash is. Neither where to use it (I mean in the "server/nginx" config). I still don't understand where to use hash except for ssl config.
--> I could use hash as passwords ?

I currently use Mitro. But useless on Android (Clipboard hijacking)

I also do use some basic options of rkhunter and fail2ban.

* Use an authenficiation for apps that don't have their own. Otherwise anyone can use it.

You can use HTTP basic auth for that. It's basic, like the name says.
https://www.digitalocean.com/community/tutorials/how-to-set-up-http-authentication-with-nginx-on-ubuntu-12-10

* Restrict access to certain machines. I know Nginx can deny access based on IP adress, I was wondering if I could achieve this using other variables such as mac adress for example?

I actually wouldn't recommend that. Mac addresses can be spoofed. I.P auth plus a password should be plenty. IP addresses can be spoofed too, but it's a little more problematic to pull off in this context.

https://superuser.com/questions/19383/why-is-mac-based-authentication-insecure

* Prevent search engines to index what is on my server. I have read that I could use an Apache .htaccess but can I do it with nginx ? What is the difference with robots.txt files ?

Use Robots.txt to tell the search engine what you want it to stay away from. Use htaccess/basic auth to make sure. The search engine can't read anything it doesn't have a password to, although it might see that there is a page there (a forbidden is sort of proof of the existence of a page in a way.)

http://en.wikipedia.org/wiki/Robots_exclusion_standard

* How would one isolate webapps ? I was wondering if I could run each apps as separate users in order to harden security. Otherwise (someone tell me if I'm wrong) a security breach in one of them (and that may happen often with young projects) could allow an attacker to have access to all www-data user files. Regarding this thread I don't know if I must investigate in php5-fpm pools or only nginx or both.

You can run the app in a safe container of some sort, like docker offers. I believe SystemD also has a native container as well. This way there is one more "sandbox" to break out of before you're in deep, deep trouble. Keep in mind that if there is a binary exploit on your server, the attacker will often up as apache or Nginx user wise, and have access to what those servers have access to. The way a lot of hosting providers do things, is that they run each site in a virtual machine of it's own. If your box has the horsepower for this, it may be a nice solution.

You do want to make sure the permissions on all of your folders are set correctly. If you use centOS or RedHat Linux it's also possible to add another layer of fine grain permissions on to web related folders to further lock them down (investigate SE linux.) Since you are on Ubuntu, that's not an option, but if you ever change you should check it out. Likewise, freeBSD has a concept of "Jails" that limits an apps access to the whole system. You may find this interesting too.

Some extra things you didn't ask about but I'll tell you

Make sure and hide version numbers wherever you can
Use HTTPS on everything
Encrypt everything you can, whenever you can.
Use the strongest ciphers you can all of the time
Use the strongest hashes you can.
Use very large passwords. Use a password manager that generates secure passwords for you. (Keepass is nice.)
If it is life and death that no one access this thing, don't put it on the internet. If people want it bad it enough, they will find a way.
Don't be afraid to use a hosting solution, where some of the security responsibility (IDS and such) fall on the hosting provider. No guarantee they will do it well, but if you are a new web developer, it will be very difficult to worry about all of that while you learn to program.


Why does SSL use both asymmetric cryptography and symmetric cryptography algorithms together? SSL uses both asymmetric cryptography and symmetric cryptography.

Why can't it, or why doesn't it, just use one of them?

Symmetric cryptography cannot be used for exchanging secrets between machines that had never communicated before, but asymmetric cryptography is limited to encrypting very small data (the size of the key) and is extremely slow when used to encrypt larger blocks. That's why all practical cryptography scheme uses both.


Export a folder from KeepassX Is it possible to unencrypted export a folder in KeepassX?

I would like to share a part of my KeepassX database with a collegue but I have all of the needed passwords in separate entries in KeepassX

Workaround:

Copy your whole database and delete all entries that the collegue doesn't need to know. Then change the password of that partial database and give it to the colleque.


Is secure Caller ID possible for SIP / VOIP? Is there any way (standard, proposed or draft) that will allow for secure Caller ID over SIP / VOIP networks?

I have constantly heard that Caller ID is insecure when used over these services.  Can anyone explain why Caller ID is insecure when used over these networks?

When the call is coming from an external PBX, then the Caller ID you receive is what the caller's service provider sends to your service provider. This could by anything the caller's service provider wants. Many service providers choose to respect that and send the real Caller ID to your service provider (and eventually, to you).

Many SIP / VOIP service providers give their users the option to set an arbirtrary Caller ID which will be sent to the callee's service provider (and eventually, to the callee).

That's how the whole Caller ID system works, it is inherently insecure because it relies on the information provided to you being accurate. Think, HTTP_REFERE.


Verify Login and Encrypt with PBKDF2 I'm writing a desktop application where I'm using PBKDF2 to generate an encryption key to AES-128 encrypt the config file. The config file contains a crypo-random key that's been used to encrypt the data for the program. The user already entered that key as provided from us on installation. The idea is they enter the crypto random key once and then they can use an easier to remember password. So far so good.

So, when the user loads the program, they enter the password. We used the password to regenerate the PBKDF2 key and decrypt the config file.

Now, how do I easily verify that the user entered the correct password? Of course, if they entered an incorrect password, decryption of the data won't work. But I'd like to reject the password immediately rather than letting the program load and then the user gets a decryption error message box.

I've read that TrueCrypt encrypts a known constant, the string "TRUE" and then verifies that the password-based key will encrypt "TRUE" to the same ciphertext. I've also read about generating an HMAC-SHA hash to verify the encrypted data. But that you don't want to use the same key for the MAC and to encrypt the data. For this reason, I like TrueCrypt's method (I don't have to track two sets of salts and IVs). I don't really care if an attacker can load the program. They won't be able to read any data. I just don't want the user to get in with the wrong password and think the program is insecure.

What's the right way to do this?

It depends whether you want to defend against typing mistakes, or attacks.

If you just want to defend against typing mistakes, just include some structure in your configuration file. E.g., define that your configuration file MUST begin, when decrypted, with the string "This is configuration file for application FooBar". If you do not find that string upon decryption, then the key is wrong.

If you want to defend against attacks (a bad guy voluntarily alters parts of the encrypted configuration file to make you load an incorrect key), then you need something stronger. The "right" solution is to use an authenticated encryption mode (my favourite is EAX). If your programming framework does not include an implementation of EAX mode, you can do something like this:

From the user's passphrase, generate 384 bits of key (PBKDF2 is a "key derivation function", it can be used to produce keys of arbitrary length). Split these into three 128-bit keys K1, K2 and  K3.
Encrypt the configuration file with AES-128-CBC, using K1 as key and K2 as IV. Call the result C (the encrypted file).
Compute a MAC value over C, using key K3. For the MAC function, use HMAC with SHA-256 (or SHA-1, but SHA-256 is preferred on a general basis). The MAC is stored along C (appended, as header, as a separate file... that's your choice).
When decrypted, to the reverse: obtain the three keys from PBKDF2, verify the MAC, and (only if the MAC was correct) decrypt the file.

This scheme would resist both attacks and typing mistakes (however, it does not distinguish between a wrong passphrase and a genuine attack).

Edit: I had left it implicit, but it would be better to state it plainly: since we are using PBKDF2, there is a salt which is used to turn the password into the PBKDF2 output. Each encrypted file SHALL have its own salt. The salt SHALL be encoded in the file header. If a file is "re-encrypted", a new random salt SHALL be generated.


What is the point of 2FA if the recovery code (which is only one factor) can be used to access the account anyway? I think the title says it all, but to elaborate:

If, say, someone were to find my recovery code, could they not then gain access to my account? Similarly, could then someone not just hack my recovery code, given enough time? Consequently, would it not be equally secure to just require a very long, and randomly generated password?

If, say, someone were to find my recovery code, could they not then gain access to my account?

As you said, this is only the one factor. That's why -most likely- the recovery codes are simple PINs and have limited time of life. If someone intercept this PIN they have to find out your real password.

  Similarly, could then someone not just hack my recovery code, given enough time?

Limited time of life for recovery code is -mostly- for this reason. In the case of someone steal your account's credentials, he/she have a certain time to provide security code. That's a way to limit (not prevent) brute-force techniques.

  Consequently, would it not be equally secure to just require a very long, and randomly generated password?

Even if you have a 24-digits password that've been randomly generated, you should think any other security threats that exists (e.g. If someone gain access in your password manager/computer/mobile).

You can find literally tons of articles that describe 2FA (or MFA (Multi Factor Authentication)) scenarios and what are the benefits that provide.

Also, to not confuse you with false sense of security by using 2FA, I better give you a -well known- case that didn't actually worked:

  Reddit Got Hacked Thanks to a Woefully Insecure Two-Factor Setup:

  Attackers got into Reddit’s systems by compromising some employee administrative accounts for company cloud storage and source code storage. Slowe notes in the blog post that the employees were using two-factor authentication to protect these crucial accounts, but some number of them had that layer of protection set up with SMS—meaning someone would need a code texted to their mobile number to complete an account login. The problem is that SMS-based two-factor is known to be insecure, because attackers can launch a “SIM swapping” attack to take control of a user’s SIM card and all the data coming to their phone number.
  source


LastPass vulnerability: Should LastPass users change all their passwords? Reading about the recent vulnerability in LastPass extensions for FireFox and Chrome.  The published exploit allows arbitrary code execution. The vulnerability also allowed access to stored passwords. I can read that the arbitrary code execution won't work unless the binary extension is enabled.  If my ..um friend used LastPass, I assume he was still vulnerable to a malicious script accessing passwords even without the binary Chrome extension enabled?

So, if this vulnerable extension has been out there and nobody has any idea if Project Zero was the first to find it, why isn't LastPass recommending that everyone change all their passwords?

Last pass suggesting people change their passwords depends on if the vulnerability was discovered before it was disclosed and solved and if users have visited an infected site in case it was. It also depends on how the vulnerability was solved.

Tavis Ormandy is a very good researcher that has been poking at Last Pass for quite a while, and while it is possible for someone else to have discovered the vulnerability before him, I find this unlikely. However, if it was discovered it was probably not very widely used, since we haven't seen any leaks in the media so far and I don't think a breach of Last Pass would last very long without being discovered. In my opinion, it's not very likely users have been hit with this.

The exploit only allows access to Last Passe's RPCs without the extension, so an attacker wouldn't be able to gain access to your master password, but to the password of a site (or possibly a few sites) you've stored in Last Pass. So if you do feel like changing your password, change the passwords of the sites you access via Last Pass, not the master password.

Finally, if the vulnerability was resolved by removing the DNS entry and not by taking down the service, a MITM could potentially obtain your account details, but the likelihood of a targeted attack is pretty low unless an attacker can manipulate a web page they know you frequent and can also position themselves as a MITM.

All of this aims to a pretty low risk of Last Pass users having been burned, if they were it was likely a small number of users. I think the media circus that would follow Last Pass suggesting all users change their passwords would create more harm than good to the company as a whole, while only having a few users being affected isn't ideal, it's more manageable from a PR standpoint.


I just found out about BadUSB. Should I worry about it although I bought my USB from official stores? I want to prevent malicious program accessing my PC via USB. My thread is as follows: I'm just a regular citizen with a non-dangerous job. However I live in a country that didn't care about data privacy and security.
Recently I just learned about the dangers of badusb. The problem is I have never checked the authenticity of my USB although I bought it all from the official stores.
To sort this out, I checked my usb collections with H2Testw. I also had time to download Beamgun app to detect badusb and all the results were positive without any issues. I have also made sure there is no Command Prompt showed on my screen when I plugged the USB.
However, new problem emerged. After I teardown some of my USB, I found a Phison controller inside. I checked on flashboot(.)ru and there is a software that can reflash that controller model.
Does that mean attacker can reflash my USB with a malicious payload?
I wasn't sure if buying from official store and checking with beamgun app and H2testw is enough to prevent badusb. Should I be worried?
What do you think about this?

While all of those concerns are technically possible, by far the biggest USB issue when purchasing from official stores is getting a bogus usb device that only stores a fraction of the claimed size or performs much slower than advertised.
A true BADusb is capable of acting before you can run analysis. If you plan on dealing with something like that you need a sand boxed system. What's more, a BADusb attack can come from usb items that may not look like anything to concern you, right down to and including a usb cable.
I've encountered bogus storage USB devices from commercial purchases occasionally, but the only true BADusb devices I've dealt with were in rather specialized environments.


What are the steps to take in order to securely transmit credit card information via a standard web form? I have a client who wants to be able to have new customers who sign up with them online for a delivery service to be able to submit their credit card information as well.  Once the information is obtained the client will manually enter this information into their POS system at their retail store.  The client does NOT want to offer clients the ability to pay online, or store credit card data, or anything else.  They only want to allow the customer to submit their card information via a standard web form. What encryption will need to be done in order for this to be done securely? (BTW...I am outsourcing this task to another, but I need to get an answer to this question ASAP so I can give my client an idea as to how involved it is.) I'm trying to convince my client to use a service and not set this up locally, but I need to know what would have to happen in order to do this locally so I can show him the benefits of using a service.

Thanks

PS: Are there services that you would recommend? Are there services that you would suggest I avoid? (Thanks BTW for all of the answers I greatly appreciate everyone's time.)

I cannot emphasise enough that this is highly "involved".

You would need to be compliant with PCI DSS, since you'll be handling card data. PCI DSS is the definition of involved. I'm also unsure as to where you stand with someone actually copying this data into a PoS, but I can imagine it would be extremely difficult to generate a complaint process that includes this step.
Data will need to be secured in-transit, so that means configuring an SSL/TLS server to only support strong, non-vulnerable ciphers, protocols and other configuration settings. You will need to purchase an SSL/TLS certificate and keep this in-date. Furthermore, you'll need to consider any transport encryption beyond the web server... for example, you definitely cannot email this data to your copy-typer.
Data will need to be secured at rest (and it will need to be at rest at some point if its not being immediately passed to a separate payment processor). This means that all card details will need to be encrypted using a strong scheme, most likely involving both symmetric and asymmetric forms. Keys will need to be securely managed to prevent the data from being accessed.
A secure Card Data Environment (CDE) needs to be established - a highly secure network that is segregated from other business areas. Access to this would need to be tightly controlled.
Both the web application (form) and the network infrastructure need to be regularly tested/reviewed for security vulnerabilities, which then have to be managed and resolved.

This really only scrapes the surface. Try the PCI DSS requirements for a full understanding of the steps involved in securely handling card data.

It would be significantly easier and cheaper, especially for a small operation, to utilise a 3rd party service that have already undergone these processes. For extreme ease-of-use, an out-of-the-box service like PayPal could be used. If you're interested in using your own form, consider a service like Stripe that can handle the back-end and security. These services are already PCI compliant.


Can a security control be both management, technical and operational? I know that security controls are divided into three categories, namely technical, management and operational. Going through them I always felt as a though a control belonging to one of the above categories can belong to an other as well. For example, i feel as though separation of duties can be classified as a management and an operational control. Hence, i wanted to know firstly, if am right or wrong in thinking so and second, if some can provide examples of overlapping security controls.

You are absolutely correct in your first question that security controls can be categorized in many different manners, and that a particular security control could possibly fall into several of those categorizations.

There is no absolute universally agreed-to set of categories either, some are older categorizations that made sense in the 1990s and 2000s, and newer categorizations have evolved to address contemporary defense strategies against threats. The Wikipedia article on Security Controls lists two categorization schemes: {Physical, Procedural, Technical, Legal} and {People, Technology, Operations}.  The IS Handbook shows another set {Admin, Logical, Physical}.  And you can google to find even more opinions about how to categorize security controls.

I would suggest however that you not get too hung up on security control categories in the first place.  They are too high level, and not very helpful in actual design and development of a security solution for a particular system.  How they are helpful is in reminding you (the security professional) that security controls are more than just technical.

A good security solution that achieves an acceptable level of residual risk is one that has a diversity of overlapping controls, that draw from ongoing security insights from talented humans and from rout operational procedures (from those humans with less talent) in addition to security technologies.  However too many security professionals just focus on the latest technical security toys, yet forget to lock the door to the network closet (to cite a trivial example).

[One side note, if you are studying for a professional credential or a security class, then no matter what you might think otherwise, to pass you will need to parrot that credential's or class' definition of categories, and where they place security controls within those categories.]

For your second amplifying question, some examples of notional security controls that may fit multiple classifications that I can think of off the top of my head:

"Ensure doors to computer equipment rooms are locked":  this is both management/physical (the locks have to be installed on the doors), and procedural/operational (a human needs to check the locks on an on-going basis typically daily).
"Audit Logs of Security Critical Events are to be reviewed immediately": this is both technical (some software or hardware has to generate those logs) and procedural/operational (a human needs to ultimately review the events and decide a course of action).
"Admins with access to sensitive database servers shall undergo periodic background checks": management (sets up an HR security infrastructure and funds/staffs it), procedural/operational (HR staff has to periodically do these checks), technical (most background checks are now performed via online services).
"Boundary Routers shall be configured to perform Network Intrusion Detection": technical (the router hardware and its software), and operational/procedural (someone not only has to configure the router properly the first time, that configuration has to be audited periodically because admins unfortunately make undocumented and non-appropriate changes to router configuration "on-the-fly").

I'm sure that other responders can suggest many more examples.


How smart card with client certificate is used during SSL/TLS session Precisely, can I remove smart card from card reader once I successfully started a SSL/TLS session? Will website still 'see' my client certificate (public key) after I removed card from the reader and navigated on the website? Will I still be able to communicate with website in the same SSL/TLS session?

Precisely, can I remove smart card from card reader once I successfully started a SSL/TLS session?

Yes. I think that is the most likely scenario. The client cert is used to establish the initial connection and negotiate a SESSION KEY. This is the initial session negotiation. After that, you can theoretically RENEGOTIATE any time the server (and sometimes the client, too) feels like it. But that depends on the specific web app. However it would be out of the ordinary, and I don't think it's very likely.

But just try it yourself and/or ask the admins of the web app.


How can I view the contents of a web page without running malicious code? I received a strange email which has some strange URL in it.  I would like to know what is "behind" the url, but without the risk of running anything malicious.

How can see the contents of the URL, the web page, without running malicious code?
I am on a Linux machine.

You can try doing that using wget

wget -O test.txt http://the-url.com/you-are-trying-to-check


Encryption and Hash in Veracrypt I have already read some topics about Veracrypt's cryptography algorithms.
It said that if we want to focus on security we need to chose a 3 layer encryption like AES(Twofish(Serpent)) or Serpent(Twofish(AES)).

I think the performance and security level is the same between those two because they use the same level encryption, we only change the order. Is my reasoning right?

Other questions :
1) Concerning the hash, I saw a lot of people advising for  Whirlpool (Sha-2 was designed for NSA). What about Streebog?
Is it less better than Whirlpool because of the performance or security?

2) I did a container on my usb stick.
Does encryption use more storage than non-encrypted files, folders?
Because i didn't notice it on my usb stick maybe 20 GB is too small.
With SSL/TLS because of encryption, we have more traffic, so I am thinking that there is something this way with Veracrypt.

I tried to find a benchmark for the storage like the benchmark performance/bitrate of encryption algorithms. But I couldn't find one.

I think the performance and security level is the same between those two because they use the same level encryption, we only change the order. Is my reasoning right?

Yes, the performance is exactly the same, and I can't see why Veracrypt would even offer a choice, as I can't see any security implications in changing the order in which the ciphers are applied. Maybe someone on crypto.stackexchange.com could offer a reason why I'm wrong, though.

I'd go further and say that triple encryption, while it certainly protects against there being catastrophic failures in two of the three ciphers, is paranoid. I'd only consider this worthwile if I needed to directly hand over my encrypted hard drive to an attacker and leave him alone with it for the next 20 years, in which all kinds of breakthroughts might be made.

I can't say much about Whirlpool vs Streebog, except that just because the NSA touches something doesn't mean it's containing a backdoor. The SHA-2 family has been reviewed by lots of renowned cryptographers who have found it solid and while that doesn't prove anything, withstanding analysis by experts is really the only measure of quality we have in the field of cryptography.

There are some attacks against both Whirlpool and Streebog, but the best ones are still completely impractical for real-world attacks (AFAIK). I think the best attack on reduced-round Whirlpool can create a collision with a time complexity of 2^120. That's still out of reach. The best known attack against Streebog has an even higher time complexity. There are also attacks against reduced-round SHA-2 hash functions, but it's difficult to put these 3 hash functions in any order security-wise.

Finally, while I'm not entirely sure what the hash function is used for in Veracrypt (besides key derivation), a weakness in the hash function should not affect the security of the encryption if you use a strong passphrase.

  2) I did a container on my usb stick. Does encryption use more storage than non-encrypted files

No, it doesn not use more storage (except for a very small header that doesn't exist with unencrypted partitions).

Veracrypt encrypts disk blocks, not files. Each encrypted block is exactly the same size as the unencrypted block. It has to be; otherwise the encrypted partition would not fit into the space reserved for the partition on disk.


Password may not be similiar to last 5 passwords SAP NetWeaver has a password policy to prevent your new password beeing similiar to the last 5 passwords.

Are the passwords stored in plaintext to verify this?

Or is something like a soundex value stored?

They don't need to have the passwords in plaintext to be able to verify that.
They could be using the best practices(PBKDF2) and still be able to spot password re-use.

You have the password hash, the salt and number of iterations(e.g salt:iterations:hash). So all they have to do is keep the last 5 passwords run through PBKDF2 stored somewhere and run the same algorithm on new passwords along with the salts of old passwords and they can determine if the password was used before or not.

The downside here is that you can only check for exact match and even if a single character's capitalization has changed you won't be able to verify that for older passwords, but since you have to enter the current password to be able to change your pass, the application can have access to plaintext version of it at that moment and have more strict checks on your very last password. And this is what SAP does, you can't enter the exact same passwords you had before and you can also enforce the user to change at least "n" characters from their previous password in their new one. (Reference)

Hash algorithms have pseudorandom output and changing a single bit in the input makes unpredictable changes to the output. So apart from using salts, iterations or whatever even in case of simple hash algorithm use like md5 or sha-1, there is no way to measure the similarity between inputs, only having access to the hash output.


MITM without spoofing (Decrypt sites with SSL + HSTS) I am developing a security information lab.

My Kali notebook is connected to my regular wifi (this is my Internet source) and the eth0 is connected in the LAN interface of a wireless router (this is the Victim's Wifi).

The wireless router's DHCP is disabled, I've configured the Kali DNSMASQ to distribute the IP configuration.

When someone connects to this wireless network, it will get an IP and use Kali as the default gateway to browse the web, since I use a proxy like Burp, Squid, or enable the IPV4 Forwarding + Masquerade.

Now I want to do a MITM attack to decrypt HTTPS traffic.

I was trying to use SSLStrip Plus, Bettercap, MITM Proxy, and I am not able to get the traffic without changing the SSL certificate or doing spoofing.

Since I control the default gateway, is there a better way to do the MITM without changing the victim's browser?

No, if you are trying to decrypt websites like facebook, google+, twitter, etc... for login credentials, it will not work. HTTP-SSL/TLS (HTTPS) will encrypt the traffic. All sslstrip does is redirect pages to non-HTTPS versions. So https://www.website.com becomes http://www.website.com. Of course this is very simplified but in turn the end result is un-encrypted traffic. It does not decrypt it. Then HSTS was created to stop this, only HTTPS pages were allowed for said sites. What SSLStrip+ does is redirect to a sub-domain without the HSTS header. For example wwww.facebook.com, then HTTP is allowed. But it works with very few sites because of the AllowSubDomains=True part of the header. This meand wwww.facebook.com is resolved to the DNS IP of regular www.facebook so data is still encrypted. Sorry. If you want I recommend just DNS spoofing non HSTS sites but asking for GOOGLE+ data to continue from your own APACHE server. (If you are on the same LAN) Then you get it anyway, but it is much easier.

Very unlikely.

Or, if you have enough control, theoretically you could install a root CA so your SSL/TLS certificate is trusted. But if you have that much control why not just use a key-logger.


Collision-free cryptographic hashing? I wish to hash something that outputs a collision-free hash, and to use that hash as an id in a database. Using conventional cryptographic hashing (fixed-length) means there is a chance of collision, and that the id might not become unique.

Does such a cryptographic hash exist?

I guess I could always use deterministic asymmetric encryption and encrypt something with the public key, throw away the private key, and use the output as a sort of hash, but anyhow -- was wondering if there are other possibilities.

Basically my problem is this -- I want each username to have a record in my database, but if someone gets a hold of my database, I don't want anyone be to able to read the username from a record. No user will ever know the username of someone else, thereby eliminating the possibility of simply hashing and testing if someone exists in the database.

What you are asking for is a random oracle, a hypothetical ideal hash that cannot create collisions unless the input is larger than the output. Such a hash does not exist in reality, and the best you can get is current cryptographic hashes that make intentionally finding collisions harder. The larger the hash's output, the lower the chance of an unintentional collision. A strong hash like SHA-256 is unlikely to ever collide, even if you were intentionally generating billions of IDs a second.

The chance of a collision is 1 - e-b(b - 1) / 2n, where n is the number of distinct IDs in your set and b is the number of bits in the hash digest. This website explains more about hash collision risks.

If all you want to do is generate a unique pseudorandom ID given a fixed-sized input, you could use a block cipher. The input is the input ID, and the output is the unique, pseudorandom ID. This can be described as H = Ek(ID), and is similar to a block cipher in counter mode. As long as the input and output need only be as large as the block size, there will be no collisions. Note that, unlike a hash, this is reversible and knowledge of the key can be used calculate the original ID.

The block size of the cipher is what determines the input and output sizes. For example, a 64-bit block cipher requires a 64-bit ID as an input, and will output a 64-bit value that can be used in place of your hash. Every distinct 64-bit input will map to a distinct and pseudorandom 64-bit output. The input can be smaller than the block size if it is padded with a constant value, but the output must be used as-is. If input or output is truncated, there will be the risk of running into collisions.

Using a block cipher may not be practical if you are converting usernames into IDs, because a 64-bit block size (for example) can accept at maximum an 8 character username, assuming ASCII. If the input needs to be of variable size, I would urge you to use a hash function. The chance of collisions for a strong ≥160-bit hash is vanishingly small. This is what hashes are designed for.


Potentially dangerous request loads the page I hosted an application in ASP.NET 4.0 webforms.

When I am browsing hostname/DressDetail.aspx?<script>alert(313)</script>&category=1&code=76 it is showing an error message like:

  A potentially dangerous Request.QueryString value was detected from the client (="alert(313)

I am expecting the same error message as above when I am browsing hostname/DressDetail.aspx?<script>alert(313)</script>=1&category=1&code=76, but it loads the page. The only difference is an extra =1 in the latter url.

Let's analyze what is happening here by looking at ASP.NET WebForms code.

First example, w/o =1

  [HttpRequestValidationException (0x80004005): A potentially dangerous Request.QueryString value was detected from the client (="alert(1)c__DisplayClass280_0.b__0(String key, String value) +22
     System.Web.HttpValueCollection.EnsureKeyValidated(String key) +9904693
     System.Web.HttpValueCollection.GetValues(String name) +17
     System.Web.UI.Page.DeterminePostBackMode() +99

If we run the code we can see that the exception originates in EnsureKeyValidated but we can get there from GetValues, from DeterminePostBackMode. So if you check there we see this:

      string[] values = nameValueCollection.GetValues((string) null);

so it's look like what we get here is retrieving all the values that are key-less. So the above query could be rewritten to the form null=<script>alert(313)</script>&. So the script is passed to be the value for an null/empty key.

Second example, w/ =1

In here you're making the key to be equal to the script, and the value for that key to be 1. The key's are encoded before they are passed to the server so this would not be an issue.

If you want to replicate the error, you could pass a=<script>alert(313)</script> and you would get the same error just originating from a different place:

  [HttpRequestValidationException (0x80004005): A potentially dangerous Request.QueryString value was detected from the client (a="alert(1)c__DisplayClass280_0.b__0(String key, String value) +22
     System.Web.HttpValueCollection.EnsureKeyValidated(String key) +9904693
     System.Web.HttpValueCollection.GetValues(Int32 index) +29
     System.Web.HttpValueCollection.ToString(Boolean urlencoded, IDictionary excludeKeys) +206
     System.Web.UI.Page.get_ClientQueryString() +411

If you need to you can control what is being denied.


Certificate management: private key distribution with Netflix Lemur framework My team has had some challenges with our current internal PKI management tools and we are looking for other solutions.  One of my team members forwarded me a link to a page about Lemur, an open source framework from Netflix.

It's a pretty well written article and most of what is discussed seems relevant to struggles I've seen and experienced but there's one thing that I'm confused about.

The following diagram is meant to show "a typical procurement process".

What I would typically do is generate a new key-pair on the host using something like the Java keytool.  This generates the key and stores it in the keystore.  Then a CSR is created and signed by the CA.  The signed cert is then imported back into the store.  I think this diagram can be interpreted to describe this process but it doesn't clearly show that the private key never leaves the 'deployment target'.

The proposed new procurement process looks like this:

Now, it would seem from the diagram, that the private key is generated on a separate server and then delivered (presumably via secure means) to the 'deployment target'.

The ability to generate a CSR and get the public key signed without needing to move a private key around seems pretty slick to me.  I thought it was designed this way for a reason.  While I can see the advantages from a convenience perspective, isn't this approach of pushing private keys inherently adding more risk of private key exposure?

The text of the article says that it can support certificates generated elsewhere which but implies that this is to help transition to using Lemur to generate them.  I'm not convinced that is a step forward.  Am I missing something?

Yup, that's how I would read that too.

I assume that for a large cloud-based company like Netflix, the Lemur server would be part of their virtualized prod environment cluster and therefore held to the same level of network security as everything else in the prod environment. For example, if the deployment target is actually a cluster of VM hosts behind a load-balancer (or the load-balancer itself is terminating the TLS connections) then some amount of private key copying will be happening anyways and they'll have infrastructure to handle that properly. Adding a Lemur server to the cluster doesn't open any additional attack surface beyond what's already inherent to a large cloud deployment.

For smaller deployments where your prod server is a single machine, then I think your concerns are justified and it's worth asking some questions about additional copies of the private key floating around.


Is my code using mysqli_real_escape_string and quotes100% safe against SQL Injection? My code is:

SELECT * FROM tlb_members WHERE username="{mysqli_real_escape_string($_GET['test'])}"

I'm searching and some people said using quotes in SQL statements is safe. Is this true?

It's mostly safe, except in some corner cases regarding certain character sets. Still, it's not the correct approach.

But first off, PDO with default configuration also suffers from the corner cases described above.

There are still very good reasons not to do it like this though:

theoretically, it just makes more sense to separate user input and SQL keywords instead of escaping.
it's generally recommended to use prepared statements, not to escape. It's not always good to go with general recommendations, but if you go against them, you should have a good reason for doing so.
it's harder to mess up prepared statements than escaping, because you have to do it right when you bind the data to the query, while escaping can take place anywhere (and often does, to avoid duplication, etc).
prepared statements always uses the same approach, just bind the data. With escaping, you have to remember to have quotes, or to cast to int, depending on the data you have.
quotes are very easy to forget and to overlook, especially in more complex queries.
it seems to me, that by using prepared statements, you focus on security, while when using escaping, it's more of a side-thought that gets in the way of the task you really want to accomplish, making it easy to forget to add escapes or quotes just once (you can't forget to bind the variables, as then it wouldn't work).
prepared statements are nicer to read than code that has mysqli_real_escape_string all over the place.
it's a lot easier to find weaknesses in your code if you use prepared statements (just grep for queries that contain variables).


key strokes from different keyboards when using multiple keyboards, it is possible to use them simultaneously.

However one thing i noticed is that key combinations are also accepted across different keyboards. for example, i connect two keyboards i press ctrl-alt on one and del on another, the input is taken.

Can there be any possible security problems or leverage in this? like, a keylogger can sniff USB packets and insert a stroke without the user noticing it?

This does not really introduce additional risk, since an attacker has either full keyboard control or no keyboard control at all. If an attacker had only access to the Ctrl key of a keyboard or something like that, he could trick you into performing actions be pressing it at the right time. However, there is not really a situation in which only some keys are available to an attacker.


Rerouting emails to external account There was a case when employee A thought he was getting legitimate emails from employee B, as the email address was valid, there were no CC/BCC addresses and just plain text in the body. Some sensitive data was exchanged at the end and an outside email address was revealed for some reason at the end of the chain. Employee B never received and replied to employee A emails. Also, exchange server ended up being down after this incident.
What could have happened?
How can this be prevented?

Email was never designed to verify an email actually came from the person it says it came from.  The model is largely one of snail mail, where it's trivial to print an address of President Of The United States as the origin.

The most likely scenario is the header address appeared as employee B, but the reply to: address was set to someone else like attacker@evil.com.  In this case, replies would go to attacker@evil.com instead of employee B.


Am I correctly preventing XSS in PHP? While building my website I put together a security class which includes two functions, one takes input and returns it as a string passed through htmlentities function of PHP. The other strips out common XSS tags etc, until now I've been using both in conjunction when outputting user inputted data to the browser Just to make it clear; my context is HTML, not pdf, xls etc (I.E. string tags then htmlentities then echo).
My question is, should I just use HTML entities on its own, is that enough?

below are the two functions I described for reference:

    public function SanitiseXSS($data)
    {
        // If its empty there is no point cleaning it
        if(empty($data))
        {
            return $data;
        }

        // Recursive loop for arrays
        if(is_array($data))
        {
            foreach($data as $key => $value)
            {
                $data[$key] = $this->SanitiseXSS($data);
            }

            return $data;
        }

        // Fix &entity\n;
        $data = str_replace(array('&','<','>'), array('&','<','>'), $data);
        $data = preg_replace('/(&#*\w+)[\x00-\x20]+;/u', '$1;', $data);
        $data = preg_replace('/(&#x*[0-9A-F]+);*/iu', '$1;', $data);
        $data = html_entity_decode($data, ENT_COMPAT, 'UTF-8');

        // Remove any attribute starting with "on" or xmlns
        $data = preg_replace('#(<[^>]+?[\x00-\x20"\'])(?:on|xmlns)[^>]*+>#iu', '$1>', $data);

        // Remove javascript: and vbscript: protocols
        $data = preg_replace('#([a-z]*)[\x00-\x20]*=[\x00-\x20]*([`\'"]*)[\x00-\x20]*j[\x00-\x20]*a[\x00-\x20]*v[\x00-\x20]*a[\x00-\x20]*s[\x00-\x20]*c[\x00-\x20]*r[\x00-\x20]*i[\x00-\x20]*p[\x00-\x20]*t[\x00-\x20]*:#iu', '$1=$2nojavascript...', $data);
        $data = preg_replace('#([a-z]*)[\x00-\x20]*=([\'"]*)[\x00-\x20]*v[\x00-\x20]*b[\x00-\x20]*s[\x00-\x20]*c[\x00-\x20]*r[\x00-\x20]*i[\x00-\x20]*p[\x00-\x20]*t[\x00-\x20]*:#iu', '$1=$2novbscript...', $data);
        $data = preg_replace('#([a-z]*)[\x00-\x20]*=([\'"]*)[\x00-\x20]*-moz-binding[\x00-\x20]*:#u', '$1=$2nomozbinding...', $data);

        // Only works in IE:
        $data = preg_replace('#(<[^>]+?)style[\x00-\x20]*=[\x00-\x20]*[`\'"]*.*?expression[\x00-\x20]*\([^>]*+>#i', '$1>', $data);
        $data = preg_replace('#(<[^>]+?)style[\x00-\x20]*=[\x00-\x20]*[`\'"]*.*?behaviour[\x00-\x20]*\([^>]*+>#i', '$1>', $data);
        $data = preg_replace('#(<[^>]+?)style[\x00-\x20]*=[\x00-\x20]*[`\'"]*.*?s[\x00-\x20]*c[\x00-\x20]*r[\x00-\x20]*i[\x00-\x20]*p[\x00-\x20]*t[\x00-\x20]*:*[^>]*+>#iu', '$1>', $data);

        // Remove namespaced elements (we do not need them)
        $data = preg_replace('#</*\w+:\w[^>]*+>#i', '', $data);

        do
        {
            // Remove really unwanted tags
            $old_data = $data;
            $data = preg_replace('#</*(?:applet|b(?:ase|gsound|link)|embed|frame(?:set)?|i(?:frame|layer)|l(?:ayer|ink)|meta|object|s(?:cript|tyle)|title|xml)[^>]*+>#i', '', $data);
        }
        while ($old_data !== $data);

        return $data;
    }

    public function EscapeOutput($input)
    {
        return htmlentities($input, ENT_QUOTES, 'UTF-8');
    }

Without deciphering your regular expressions I tell you that you are doing this wrong, here are some examples why:

HTML entities and attributes are changing all the time, you can't really blacklist things.
You can filter the input to avoid HTML tags altogether. This way you will still be vulnerable if you put the filtered data inside script or style tags for example.
You may need to accept formated user-supplied data (think FCKEditor), and you would kill the formatting with your filters. At this point you would basically have to deal with XML that you can't possibly parse with regular expressions.
The backend database or other system components can format the already filtered input in a way that it is becoming harmful on output (see the ValidateRequest filter bypass).
Also, good luck with debugging your code!

I would recommend not reinventing the wheel and separating your views from your controllers. Using some template engine/framework that HTML-encodes all template parameters before output will help a lot. If you need to display formatted content you can use HTMLPurifier.


I think I accidentally DoS'd a website. What should I do? I was browsing a website, and stumbled across a sample scheme for password-protecting web pages.  The owner of the website specifically had a page that invited people to attempt to hack it.

I wanted to give it a try, so I wrote up a quick python script a few hours ago to try brute-forcing the password.  (Which, in retrospect, was a stupid idea).

I left the script running for a few hours, but came back to find that my script was running haywire and the website was returning '509 Bandwidth limit exceeded' errors on all its pages.  ([EDIT]: I also checked via 3g on my phone, and using a school computer, so I know it's not limited to just my ip address)

This is not something I had intended to do, and feel really, really bad about it.

Should I send an email apologizing and offering to pay reparations?
Or am I just unnecessarily worried, and should let this blow over?

(I'm also not sure where in stackexchange to ask this question, but I think it might fit here).

[UPDATE]:
I sent an email apologizing -- once the site owner responds, I'll update this post.

[UPDATE]:
Well, it's been several days now.  The website is still down and the owner hasn't responded yet.  I originally wanted to wait for a response first before accepting an answer, but it might be a while, so I'll pick an answer.

First off, let me say this: I respect the ethics of anyone who would ask this kind of question (rather than just closing their eyes, walking away, and forgetting the whole thing).  My compliments to you.

Ultimately, this is a matter of personal ethics, so it is hard to give advice.  You need to do what you feel is right.

That said, your suggestion to try contacting the site owner seems reasonable to me.  I suspect that any harm done will be minor or that the cost will be minor.  Normally, the cost of bandwidth is pretty modest, in monetary terms.  But the site owner might appreciate hearing that his/her site is unreachable, and appreciate the apology.  But it's up to you, and what feels right to you.


How to notify Adobe about a software issue Recently, I stumbled upon a way to reset the software trial of any product under the adobe suite. It's as simple as changing some attributes within a few files. I'm assuming that it can be deemed an issue because it shows no signs of piracy (such as a replaced .dll). On their website they have a program set up only for web app vulnerabilities to be reported, and they have a contact email for program vulnerabilities. They also have a bug/feature request forum, but I do not want to put this exploit on there.

Would this exploit be considered a program vulnerability? Would Adobe take a look at the exploit that I found and patch it? Should I not bother reporting it?

My 2 cents (even though this is an old, and probably un-monitored, thread).

Organizations don't invest in effort unless it has some return. Let's see if putting effort on closing this vulnerability has any return or not.

This vulnerability affects all trial versions of Adobe software. But, what is the impact here? What happens if someone resets the trial version? Does it become a full version of the software? If yes, then this is cause for concern.

But, if even after resetting the version, it remains a trial version, then it is not much of an impact. It is similar to un-installing the current trial and re-installing it again.

So, i don't think it would be deemed a vulnerability. Even if you reported it, they will not treat it as a vulnerability.


How can one trace and prove who leaked a document? Imagine I have a document with confidential information (new technology, stock information, ...)
I would like to send it to a couple of people for review
They will all sign an NDA
But someone leaks it

Suppose I can find the leaked version back, is there a way to sent it in such a way that I could trace and prove who leaked it?

I would imagine having to sent it to a third party who makes a unique version of the document (eg by hiding a key in some images) and who has asked the destination person to provide the key that makes it unique. This way they can certify that that person received that version and that he is the only one. He will also be the only one capable of opening the document if it is also encrypted. I will not be able to reproduce that document, so I can not falsely leak and accuse someone. And I have a third party witness.

Does such a service exist and how does it work?

It quickly changes from a technology based solution into an armed guards standing in the room solution. You can use a unique watermark on each page, you could make minute changes to characters on a page, but anyone can still retype the document if they are given unrestricted online access to it.

You could approach the problem slightly differently if you make two groups of secret information, the type you need the whole digital document for "this is a photo of bigfoot" and the type you just need to look at and remember "the next wining lotto numbers are going to be 11,16,23,34,43,44". But this only works if someone leaking the first type of information just sounds like a crazy person "The DEA have a photo of bigfoot, I've seen it!".


How are RADIUS packets encrypted? This seems like an obvious question, but I can't easily find a clear answer.

I'm setting up a FreeRADIUS server on my LAN just for curiosity's sake, but I want to know if the packets are encrypted at all by default, and, if so, how?

I know requests are sent with a shared secret that acts as a password. I would hope that even by default some form of encryption is applied to keep that safe over the wire.

RADIUS by itself provides no  encryption of all traffic. It protects only a small part of the traffic, notably the passwords. To cite from Wikipedia: Radius - Security:

  The RADIUS protocol transmits obfuscated passwords using a shared secret and the MD5 hashing algorithm. ... additional protection, such as IPsec tunnels or physically secured data-center networks, should be used ...  the user's security credentials are the only part protected by RADIUS itself, ... The RadSec protocol claims to solve aforementioned security issues.

RadSec is supported by FreeRADIUS. But to actually use it you of course need to configure it with the necessary certificates (i.e. no "encrypted ... by default") and your (unknown) radius client must support RadSec too.


Guest Sessions and CSRF What is considered to be common practice for limiting the session expiration for non-authenticated users? The reason we are using a session for guests is to prevent cross site forgery requests when guests submit a form. We are considering implementing a session keep alive for guests as well as admins, or extending the session expiration to something longer than php's default 24 minutes in the case of non-authenticated guests.

Clarification: This question is in regards to anonymous guests, which do not log into the site.

I would recommend using several unique identifiers in this case, e.g. user's cookie with some random and unique string, let’s say USER_ID, and a session token e.g. SESSID. The session token should expire as it is supposed to, however the USER_ID remains. This way you will be able to identify users, who have previously visited your website and still use new SESSID as protection against CSRF.

Extending lifetime for sessions is not a good idea, especially if you use this token to verify user's identity (in case with admin account).


Extracting openssl pre-master secret from nginx I have to store pre-master keys for all TLS connections due to regulator request. We are using nginx to terminate TLS.

I've read Extract pre-master keys from an OpenSSL application and especially excellent walkthrough Extracting openssl pre-master secret from apache2 and I was able to record keys from apache, but still have no success with nginx. Perhaps I'm missing something obvious?

I'm using Debian 9 system for testing.
First I check which version of openssl is used by nginx:

# nginx -V 2>&1 |grep SSL
built with OpenSSL 1.1.0k  28 May 2019
# ldd /usr/sbin/nginx |grep ssl
    libssl.so.1.1 => /usr/lib/x86_64-linux-gnu/libssl.so.1.1 (0x00007f9bd9f95000)

So I installed libssl-dev package which provides 1.1.0k-1~deb9u1 version.

I downloaded sslkeylog.c and compiled it: cc sslkeylog.c -shared -o libsslkeylog.so -fPIC -ldl

I put compiled library into /usr/local/lib/libsslkeylog.so path for convenience.
Then I edited nginx's systemd config:

#cat /etc/systemd/system/nginx.service.d/override.conf
[Service]
Environment=SSLKEYLOGFILE=/tmp/premaster.txt
Environment=LD_PRELOAD=/usr/local/lib/libsslkeylog.so

# systemctl daemon-reload
# systemctl restart nginx

I can see that LD_PRELOAD works - lsof of both master and worker nginx processes show that /usr/local/lib/libsslkeylog.so is loaded:

# lsof -n -p 10313 |grep ssl
nginx   10313 root  mem    REG              254,1   442984   3255 /usr/lib/x86_64-linux-gnu/libssl.so.1.1
nginx   10313 root  mem    REG              254,1    14224  20914 /usr/local/lib/libsslkeylog.so
# lsof -n -p 10314 |grep ssl
nginx   10314 www-data  mem       REG              254,1   442984   3255 /usr/lib/x86_64-linux-gnu/libssl.so.1.1
nginx   10314 www-data  mem       REG              254,1    14224  20914 /usr/local/lib/libsslkeylog.so

But after I access nginx through curl

curl -k -I https://localhost

or through browser on my PC, /tmp/premaster.txt is not created

What am I doing wrong? Or is there a better way to store pre-master keys in nginx?

Well, as I was pointed at nginx mailing list, nginx removes all environment variables inherited from its parent process except the TZ variable, so once I defined needed variables in nginx.conf

env LD_PRELOAD=/usr/local/lib/libsslkeylog.so;
env SSLKEYLOGFILE=/tmp/premaster.txt;

keys started being recorded as expected.


What can someone gain from basic personal data? I've recently received a series of weird emails which I believe to be phishing attempts, the only thing is, I'm not quite sure what they're going for and I'd really love to figure it out.

The emails are sent from a babysitting site run by our school which I am a part of, I've asked friends and the emails seem to be going to most students with accounts on the site, not just me. The sender asks for babysitting for their child, then if you follow up, the send a super long email written in poor English with random details about the family and kids always including this bit:

  I will also instruct our estate agent to mail the keys of the
  apartment to you so as to do all other necessary preparations before
  we arrive.The following information would be needed to make out the
  check to you and to get an head start

  Full Name:
  Full address with zip-code & Apt Number:
  Age:
  Gender:
  Phone number:
  Acceptance of offer:
  What time you would be available during selected days:
  Do you have any special attitude?
  Do you have any crime records?

I've received two sets of these messages so far, in each, the names and family details are changed but everything else remains identical. Additionally, the sender always claims to be some executive assistant at one of our grad schools but uses the name of an undergraduate student, even faking their email address to look like it comes from our school (something like studentname.schoolname@gmail.com)

I know they're trying to get something, but I can't figure out what they might gain with just your name address and phone number?

On another note, I've reported these emails to my school but they really haven't taken any action, all they've said is to ignore the emails. It seems like there's a bit of a security breach here though if this person is able to make an account on the babysitting site (you need a school ID or other official login to get on) and is also stealing the names of undergrad students (admittedly less difficult but still weird).

Shouldn't there be a way for the school to track the user and see how they first created their account and gained access to the system and prevent future attempts? At least they could send out a warning email to the students with accounts on the babysitting site right?

TL;DR: this email is probably just the beginning of the scam.

Like marijuana, it could be a gateway email. The thought here being that if you are stupid enough to respond to this initial ruse, they will follow-up with another claiming to need some additional info like bank account to wire money into, the initial email gives them enough pieces to research your full name, DOB, maybe even last 4 of SSN, etc with a tool like Intellius (for extracting money later).

Not sure what the school can/will do about it. In reality, it's probably an international IP and the laws won't really allow for any prosecution -assuming they are using their real name and real account to register the email server in the first place ;)

Agreed that the school should send a warning about the scam, but that's just IMHO.