CSRF payload delivery If an attacker successfully delivers a CSRF payload by any means, what response can he can see once a victim clicks the link?

None, generally, unless the target site changes in a way that the attacker can detect. CSRF is generally a blind attack; the attacker gets no more feedback that a victim clicked the link or loaded the page than they would about anybody on the internet clicking a link or loading a page on some site that both had visited.
There are some possible exceptions, though:

If the origin of the attack is controlled by the attacker (say, their own personal site), they can put script in that notifies the attacker before attempting the attack. It's not possible to tell whether the attack succeeded - same-origin policy prevents that - but it's possible to tell when it started if you can control scripting around it.
If the attacker is in a position to monitor the victim's network traffic, then it will be possible to determine the extent of the victim's interaction with the target site. Intercepting the actual HTTP is probably impossible, since it will be protected by TLS, but TLS doesn't hide how much traffic is sent each way, or the timing of the request and response. That might be enough to infer whether the attack succeeded.
If the target site changed in some detectable way, this may be visible to the attacker. Some simple toy examples: if you use CSRF to force somebody to tweet a message, you could see the message they posted. If you use CSRF to force somebody to transfer money to your account, you'll be able to see the incoming transfer.


How does correct grammar affect password security? When using the XKCD password methodology, entropy is calculated solely on the basis of individual words, assuming that the individual words are independent. This is, of course, not necessarily a valid assumption, unless you specifically ensure it when you generate passwords; and a password made of four random and independent words is still harder to remember than a grammatically correct phrase. zxcvbn similarly reports entropy based only on the individual words found, without apparently carrying out any calculation of relative frequency.

Presumably, with a sufficiently large N-gram database, you could generate a reasonably sophisticated statistical model of the word usages of correct English and order password guesses of the XKCD form accordingly. So, the question: how much entropy is lost if using a memorable, grammatical phrase for a password, by comparison to the same number of words independently selected? How much longer must a grammatical password be to provide equivalent entropy/security? Are password crackers actually using this method?

In general, any information which can narrow the search space for a password will
reduce the strength of that password. So, in theory, it would make sense to assume
that grammatically correct passwords are potentially weaker than those which are a
collection of unrelated words or have deliberate grammatical errors. However,
calculating exactly what the differences would be is extremely hard.

Many password cracking programs will allow you to define complex patterns. For
example, it has been observed that people often use dates as a way of including
numbers in a password i.e. password1961 or even password171067 (or password101767 for
US date), so some password crackers will search for things like
[dictonary-word][year] and [dictionary-word][date], where the numbers in the
year/date will be restricted to digits which would be valid and within an 'expected'
range (i.e. assume year/date is related to current/recent period or users date of
birth etc). Likewise, studies of passwords indicate people tend to do things like put
'special' characters at the boarders of password components i.e. password:1972. This
might suggest it would be a good idea to not use digits of this format and consider
using 3, 5, 7 digit numbers rather than 4 or 6 and if you add special/punctuation
characters, do so in /unusual/ positions i.e. pas:sword1972 (and of course, don't use
'password' :-(

As a cracker, the challenge of using grammar would be in how to model it. For
example, English has a very complex grammar. This is partially why natural language
processing is such a challenge. Theoretically, if you could define the grammar with
sufficient accuracy and had a large enough dictionary, you could generate a system
which could produce a dictionary of /valid/ sentences. However, this would still
represent a very large search space. If you know exactly how many characters are in the password, this would help reduce the search space, but it would be very
large. What would need to be determined is how much smaller such a dictionary would
be compared to a similar dictionary just consisting of random words concatenated
together. It would be smaller, but whether it would be sufficiently smaller to make
any practical difference is unknown. If the grammar based dictionary meant an average
search time of 50 years and the random word dictionary represented an average search
time of 500 years, in reality, neither approach are going to be useful (assuming
there are no other optimization which could reduce the time to a level which would be
practical).

Rather than a grammar based dictionary, I would probably compile a dictionary based
on quotes, well-known poetry and song lyrics. My theory is that when people use a
phrase as a password, that phrase will be something which is easy to remember and
therefore likely based on a song, poem or favourite quote. This would be an even
smaller dictionary. The challenge would be in building the database and ensuring it
is sufficiently comprehensive. Probably something which is getting easier given all
the digital repositories of quotes, songs, poetry etc out there.

Personally, I wouldn't worry about this too much. Obviously, it would be best not to
use well know phrases and it would be quite important to not use a phrase which
someone might be able to identify via social engineering techniques. If your a
military person, don't use famous military quotes/speeches, if you're a Christian,
avoid using quotes from the Bible, if your an obsessive fan of some
singer/actor/whatever, avoid using quotes from that person. Essentially, avoid using
anything which anyone who does some research on you might be able to use to narrow
the search space. I would also suggest using as long a phrase as possible. A very
long known quote is probably stronger than a shorter set of random words simply
because the search space is larger.

If you can remember a random set of words, then do that. However, if you can't, then
use a grammatically correct phrase, but make it as long as possible. Remembering the
password is probably as critical has ensuring it is strong. I've frequently found the
weakest part of many systems is their password recovery process and think you should
do as much as you can to avoid ever needing to use such a process. Enter the phrase
in reverse order (or some other pattern you can remember), insert special characters
and numbers into the words, not between them and avoid number patterns such as 2, 4
and 6 digits and stay away from quotes/phrases which someone could associate with
you.


How do I secure a nonce value within app whose source code is public? I am developing a plugin for Nylas N1 (implements Node). The plugin will be using an implicit flow to authenticate the user, as I understand that is the best way to handle client-side applications. I have a vague understanding of how state (or nonce) works, but do not know how I should verify the requesting application.

The source code of Nylas plugins are not encrypted and are easily browsable on the end-users file system. It seems to me that an app could pretend to be Nylas by modifying headers and other parameters when requesting the nonce from my server, so I am unsure of how I should go about validating these requests.

I'm one of the core maintainers of Nylas N1. I think the other answer is good general advice, but here are a couple more tips specific to N1:

If you want to secure a process or algorithm, you can write it in a native node module which is distributed in binary form. We don't currently do this, but many other JavaScript based apps do (Spotify's DRM is in a C++ library they distribute alongside the JS.)
If you want to authenticate the client with a service, use 3-legged OAuth. With 3-legged OAuth you distribute the Application ID but not the Application Secret in the client. When the user signs in, a Code is returned, and you hand that Code to your own server (the third leg), where the Application Secret is used to exchange the code for a token, which is sent back to the client. This process is a pain to implement, but ensures that the only sensitive tokens the client ever has are for accounts the user authenticated.
If you want to store tokens, user API keys, etc. client-side, we suggest using node-keytar. It's already available in N1 via require('keytar'). It provides a simple API for storing secrets in the user's keychain on Mac, Windows, and Linux. We currently use it to store N1 API tokens.

Hope that helps! Feel free to reach out to me or other Nylas engineers on our community slack channel at http://slack-invite.nylas.com/


Avoiding having emails being traced I am writing a novel and the main character sent anonymous emails using Outlook and a VPN on an iPhone to disclose information about the mafia. Now, the police are investigating it. How can he avoid getting attributed to the emails? Is there anything he can do?
The police sent a request to Microsoft. Everything is taking place in Italy and I checked laws in Italy, and it looks like it takes them 3 weeks to get info to the police.
I need a credible story and for him not to be caught. The police are corrupt!  Oh, and he closed his Microsoft account, but those stay open for 60 days, apparently. What can he do?

The police trace the email account that sent the emails (i.e. Microsoft, in this case) and contacts the email service for information. The email service checks its logs for the IP and any other information tied to the account and the device that sent the emails. The account might be closed but the logs last far longer than the account.
The police then trace the IP to see where it was sent from. In this case, it will be a VPN, but most VPNs keep logs, so the police can get the real IP of the user. The police take this IP and go to the mobile phone provider and ask who was using that IP at the time the email was sent, and the mobile provider gives the police the user's account.
I would suggest that the character not send emails the way you outlined if they do not want to be caught. Use Tor on a desktop to contact a secure email service like Protonmail and send emails from there. Services like Protonmail do not collect user data and Tor masks all the IP traffic. The police won't have anything to trace at any point.
There are also other things the character could do to be even more secure, but for the purposes of a novel that isn't about security techniques, Tor and secure/anonymous email services are enough to be plausible that the police won't find the character.


Does subterfuge work on ALL networks? Does subterfuge's ARP poisoning attack work on all networks? If not, what kind of precautions can be taken against it? Meaning, what kind of networks, if any, does it fail on? My understanding is that the only way to fight the attack is to have some sort of CA or web of trust; since wifi and ethernet networks don't have that capability, every network should be vulnerable. Am I right?

No, it isn't a silver bullet, for example:

You are using static ARP entries. This will completely mitigate the risk of ARP spoofing.
You are using encryption and you are using it properly. The bad guy can sniff your traffic, but he can't do anything with it.


How can someone stop clickjacking? I was looking at a lecture of clickjacking and when I tried to create an iframe to go to website, I noticed that websites with no https are able vulnerable to clickjacking. Is there another way to stop clickjacking without SSL or do you need to use something else?

There is an anti ClickJacking HTTP header you can add to your responses.

X-Frame-Options: DENY
X-Frame-Options: SAMEORIGIN
X-Frame-Options: ALLOW-FROM https://example.com/

Deny will stop the content loading into a frame, iframe or object, Same Origin will allow loading into pages on the same domain, 'Allow From' allows you to specify URIs that may frame your content.

The browser implements support for this, so there is a reliance on the user using a browser that complies with the header, though major browsers have supported this for a while- support is in place for IE11, Edge14 and Chrome 49.

You should configure your webserver to  add this HTTP header to responses

You can also use frame ancestors if you are using a Content Security Policy.


Avoiding HIPAA, will this work? I'm building a new website, and I'm trying to figure out if I need to worry about HIPAA. And if I do, I'm trying to figure out a way I can stop worrying about HIPAA. An example of something kinda similar, is the symptom checker on WebMD. You can put in some info that's considered personally identifiable, along with your symptoms. Then it gives you some possibly relevant medical information. But they have this disclaimer:

  This tool does not provide medical advice It is intended for
  informational purposes only. It is not a substitute for professional
  medical advice, diagnosis or treatment. etc...

My question is, does that disclaimer make them immune to HIPAA? And if it does, would it still work if people had to pay to use it?

I'm just trying to get an idea what might be ok. I'll definitely do more research or ask a lawyer, if it seems like the right way to go.

edit: The first version of my site may not fall under HIPAA's rules. But if all goes well, I may add stuff, or have customers who are covered by HIPAA, that would require me to comply with HIPAA. So I'll build my site with HIPAA, and other similar legal complications in mind. Also, both answers and the discussion, were very helpful. And I can't really say which answer+discussion was more helpful. But I really should pick one, so I will. Thanks for the help!

I am not a lawyer.  This is not legal advice.

That said such a site does not seem to be a health care provider, health (insurance) plan, health care clearinghouse, or a business associate of one.  Therefore, HIPAA's rules do apply to your website.  HIPAA's privacy rule only applies to health care providers, health plans, and health care clearinghouses and their business associates.  If you are unsure of whether you are one of these groups, please consult the flowchart from CMS.gov (medicare) (link to page where the PDF is listed).

That said it is still a good idea to protect user's health care data as much as possible, and there are other privacy laws that may be relevant.  For example, Europe has very strict privacy rules (even if they are rarely enforced).

Furthermore, you probably could be a covered entity and create a symptom checker that is HIPAA compliant, especially if the data is anonymous (e.g., not individually identifiable) OR the health care data is only being disclosed to the individual (or their personal representative) OR you have permission in writing from the individual to disclose their health information OR it falls under HIPAA's defined provision of "minimum necessary" use and disclosure (e.g., disclosed to your doctor, nurses, etc who are treating you, as well as health insurers or other people who need the information to properly bill you, etc.).

The reason you want that sort of "not medical advice ... for informational purposes only" disclaimer is not due to HIPAA.  It is to limit being sued for medical malpractice.

If your health tool misdiagnoses someone -- e.g., "you have a common cold ... get bed rest" and it turns out the person had a MRSA infection and they ultimately died as they delayed treatment, someone may try and sue you.  That sort of "informational" disclaimer may lessen your legal liability in some jurisdictions.  That said in other jurisdictions, you may still be held liable for giving bad medical advice if your advice is demonstrably negligent, especially if the disclaimer was small print that's usually ignored or quickly clicked through in an unobtrusive manner or you were charging for the service or it was advertised/described elsewhere as providing medical advice.


Where to store tokens for analysis team members As part of their day-to-day work, each member of our analysis team must handle a variety of sensitive information. For example: username and passwords for our internal databases, and tokens for accessing APIs. Some of this is specific to each individual, while some are shared by the whole team.

Ideally, each team member would only need to enter some individual login information once and then have automatic access to everything. For instance, our custom analysis libraries would need to be able to find the tokens it needs to access the web services we use.

What is a best practice for handling this type of situation?

You are looking for a password vault solution like KeePass, Lastpass or Bitwaren. Because you have shared passwords as well, an online solution would be the preferred option.

There are many different products available with subtle differences. You have to evaluate for yourself, which flavor is right for you. If it is an online solution, you should opt for an on-premise implementation, where you have full control over the server. You do not want to push your credentials into a cloud system managed by a third party.

Such a solution would fulfill your requirements. Each user has to login with his credentials on the platform and gets access to the credentials and tokens that he or she needs.


Does wireless card need to be on same channel as AP to sniff beacon frames? OBJECTIVE

Essentially, my goal is to emulate something like airodump-ng wlan0

Here is a link just in case ... airodump-ng

Collects raw 802.11 frames
Displays nearby access points and data

GAMEPLAN / OBSERVATIONS

I did a quick airodump to see if my results would be close to the same. I see that airodump is hopping channels !!!!, collecting beacons, and displaying the nearby aps.

I want to see what I can pick up using Scapy and sniff() without hopping channels.

So, I close airodump and fix my wireless card to channel 1 with iwconfig wlan0 channel 1.

Then, I use Scapy to sniff() beacon frames subtype=8 from APs within range of my wireless card.

However, I compare my results to what I got from airodump and I see that I've got a bunch of beacons from APs on all different channels. I was expecting to only see beacons from channel 1.

QUESTION

Is this a glitch? Is there some sort of benefit that airodump gets from hopping channels or is it unnecessary to be on a specific channel to collect beacon frames from all channels?

Or does sniff have channel hopping built in?

You can only listen to signals on the correct frequency band (channel).  This is why tools that attempt to give a full listing will necessarily browse through all the channels.


Can IT see my Google Drive traffic? I'm on my phone but on the work network. What could they see about my Google Drive traffic? Could they see folder and file names? Could they see documents and photos?

It's encrypted, so would they just see generic Google Drive traffic or can they see details or the actual documents and photos themselves?

The answer is no and yes too.

Why no: It's a HTTPS traffic and firewalls these days have application identification or deep packet inspection (whatever you call it). That will identify the application you are using, but not the actual traffic.

Why yes: If the IT has implemented "SSL decryption" on their firewalls they can actually see the data inside it very clearly. That's the control they have and you won't even know your traffic is being decrypted. You can confirm this by checking the certificate you are getting once you access any site (man-in-the-middle).


Any real-world examples of root certificate store compromises? Apart from the infamous Superfish/Lenovo case this year, are there any other known cases of a malicious root certificate being installed on a target machine to allow transparent MITM attacks, whether by a foreign government, intelligence service, employer or Russian hacker ?

The same software library that Superfish uses is present in other products beside those found in Lenovo products last year: http://www.tripwire.com/state-of-security/latest-security-news/researchers-reveal-evidence-of-other-superfish-style-attacks-in-the-wild/

Then there are the 2011 Comodo and DigiNotar breaches, which may be the most famous, early root certificate compromises as they were commercial Certificate Authority vendors. Their root certificates were already trusted by most, if not all, browsers at the time. The breaches included the issuance of false certificates impersonating Google, Yahoo, and others.

(https://nakedsecurity.sophos.com/2011/03/24/fraudulent-certificates-issued-by-comodo-is-it-time-to-rethink-who-we-trust/)

(http://arstechnica.com/security/2011/09/comodo-hacker-i-hacked-diginotar-too-other-cas-breached/)


Network Configurations of VMs I have installed 2 VM's on my Windows 7 machine: Backtrack (kali) and Metasploitable.

When I run a nmap scan on metasploitable from metasploitable VM itself, it shows that 3306 port is open.

But when I run the scan from Kali all ports show closed. Also when both are in NAT network configuration, their IP is the same.

Is this some issue with the network adaptors?

I was having the same problem and I figured it out. I am using VirtualBox but this solution will work for VMWare also.

First, before opening any VM's, go to File>Preferences (this will bring up the VirtualBox Preferences) and select network. Click the Add New NAT button on the right. Here you need to specify the default gateway. I used 192.168.0.0. Click OK then open up your VM's.

My two machines are now 192.168.0.4 & 192.168.0.5 when at first they were both 10.0.2.15. This was resulting in the closed ports like you say because the Kali machine was Nmapping itself! Now it properly scans Metasploitable 2.


More clarity on Certificate, public key, hash I'm new to this certificate and public keys. So I've a certificate. I exported as .pem. I opened it in textEdit and it looks like the below.

I've used below command to see what this certificate contains.

openssl x509 -inform pem -text -in test1.pem

then I see some data like issuer, company etc. Also I see public key info. which looks like below.

Now what is my public key here. Modulus is something product of the 2 chosen large prime numbers. In the below it is separated with xx: xx: xx: .. etc. is it a continuous large number in hex format? exponent should be the E with which we encrypt.

Finally, How to see only encoded public key from a certificate?
How do we take sha1 hash to hash the public key?

What you are looking at (PEM, text) are just two possible views of the same data.

  what is my public key here ... is it a continuous large number in hex format

A key is a sequence of bytes. Hex format is just a representation of these bytes as text in order to be viewable by a human. There are different kinds of public keys (RSA, ECC,...) and what the sequence of bytes exactly mean depends on the kind of.
What you see here are not the pure bytes of the RSA key itself but already an interpretation of the bytes, i.e. the modulus and exponent of the RSA public key.

  How to see only encoded public key from a certificate

The public key can be extracted from the certificate with

$ openssl x509 -in cert.pem -pubkey -noout

If you only want to get to the bytes of the key itself and strip the encapsulation you can use openssl asn1parse -in pubkey.pem -dump to get to the details. See also RSA: Get exponent and modulus given a public key on how to extract exponent and modulus from the public key.

  How do we take sha1 hash to hash the public key?

Once you have the public key as PEM (as above) you can convert it to binary and take the sha1 of it. Conversation to binary is done by stripping the PEM header and footer (grep -v '^-') and then converting the rest from base64 to binary (base64 -d):

$ openssl x509 -in cert.pem -pubkey -noout | grep -v '^-' | base64 -d | openssl sha1


How to whitelist IP address mod_security CentOS 6 Is it possible to white list an IP address in mod_security?

I found white ist whole domain name in mod_security. But I want to white list only the administrator IP.

OS: CentOS 6
Server: Apache httpd 2.15
Mod Security: Version 2.7

Found the way.

vim /etc/httpd/modsecurity.d/activated_rules/modsecurity_crs_10_whitelist.conf

And add this line:

SecRule REMOTE_ADDR "^192\.168\.50\.1$" phase:1,log,allow,ctl:ruleEngine=Off,id:999945


What is the best strategy to store and share pem files between team? Our company's small tech team works with several different servers, to which we connect with pem files. What is a good way of storing the pem files so that it can be accessed by other team members if necessary?

A (probably bad) example of how to fulfill this requirement:
Place the files in a Google Drive folder with access restricted to tech team members and our supervisor.

PEM files should not be lost if, for example, a fire destroyed all our workstations simultaneously.

The right and only answer is do not share secret keys!

Things like private keys in PEMs are often not changed regularly and you have no way of auditing who is using the key. The keys can also be easily copied by an employee leaving the company or be leaked/hacked.

The best solution is to have keys issued to individual employees and ensure passwords are used to pretect them. You should also have some software/scripts on the servers to properly maintain the trusted public keys.


Generate a password dictionary from simple information Suppose that we are going to perform a dictionary attack to crack the password of a known account. If we have some simple information from the account owner, such as first name, surname, age, date of birth, birthplace, etc, in form of a wordlist, is there any tool to automatically generate a more complex password dictionary, say by combining different words, capitalizing them, mutating, etc?

There is already an open source tool out there that does this. It's called CeWL. It comes with Kali Linux or available on GitHub.

You can also use Crunch.

A third option: Transmute.py


Basic TLS questions: Implementing a specific TLS version and cipher I've worked with TLS certs before, but only on a basic level. I'm trying to understand some specific recommendations for implementing TLS (quoted below).

(For context, my goal is to secure HTTPS connections to a web page which collects user information via a form.)

Here are the recommendations (they are from this article):

  If you are not a government organization but have HIPAA-compliance requirements and have to interact with people using a wide array of systems and devices, we would recommend the following:

  Support TLS 1.0, 1.1, and 1.2+
  Use all of the non-DES ciphers from [certain lists]

Below is my attempt at interpreting this. I'm hoping you can tell me what I've gotten right or wrong.

The TLS version is a property of the connection (in my case, between the browser and the web server) – not a property of the certificate. In other words, when I see "Protocol: TLS 1.2" in the Security tab of Chrome's dev tools, it means that the browser is communicating with the server using version 1.2 of the TLS protocol. It doesn't make sense to talk about the TLS version of a certificate.
The recommendation to support many different ciphers only applies if I'm implementing a TLS client. In my case, the browser is the client – so, when I generate my cert, I just need to choose a single cipher which (a) is on the approved list, and (b) is supported by all major browsers.

Is this accurate? Inaccurate?

The TLS version is a property of the connection

Correct. The certificate has nothing to do with the TLS protocol version.

  The recommendation to support many different ciphers only applies if I'm implementing a TLS client. In my case, the browser is the client – so, when I generate my cert, I just need to choose a single cipher which (a) is on the approved list, and (b) is supported by all major browsers.

Mostly wrong.
The server should support at least some of the (secure enough) ciphers the client supports. Since different clients might support different ciphers the server should better support a sane and secure set of ciphers to support a variety of clients instead of only a single cipher. See recommendations from Mozilla.

Also, the cipher has mostly nothing to do with the certificate. While ciphers with RSA authentication can only be used with RSA certificates and ciphers with ECDSA authentication only with ECDSA (ECC) certificates one cannot choose a specific cipher when creating a certificate. In other words: a certificate can used with lots of different ciphers. It is only necessary that the kind of public key in the certificate (RSA or ECC) matches the kind of authentication in the cipher (RSA or ECDSA).


Do I need to password protect [web] services that are only accessible internally? I have transmission-daemon setup with RPC enabled using a whitelist. The whitelist contains only 127.0.0.1 and my virtual private network range of IP addresses. I connect most of my devices through an openvpn server, and so I am wondering why I would need to enable standard auth (user/password) for services that are only accessible internally/by me. I know that this is only as secure as safe I keep my VPN/ssh keys. I am the only one (besides the hosting company) that has access to this server, so I can't really find a reason to have a username/password which gives me more things to remember and makes the process of using these services generally more cumbersome. Thoughts?

By having mo auth you are opening up more attack vectors. Couple of examples I can thin of:

Network is compromised and the attacker manages to get one of the IPs from VPN range
VPN is compromised and attacker gets access to the network that way
Another service on the server is compromised and attacker makes the requests from server (127.0.0.1)

All these attack vectors would give the attacker full access to the service you have described. Having auth on the service would fix that.


How do very big companies manage their most important passwords / keys? Third-party password managers such as 1password, etc. are useful for people, businesses, etc. to store passwords. But I bet Facebook, Google, Twitter and other super big tech companies don't use such third-party services for their internal passwords and have their own password managers for their most critical passwords.
How can a very big company manage some of the world's most sensitive passwords? (example: Gmail team root access password!)
Even with the most advanced password manager, you still have the problem of the master password.
Should this be shared among a few trusted people? Or kept by only 1 or 2 people (then what happens in the case of an accident?)
Are big companies known to use implementations of Shamir's Secret Sharing?
More generally, what are well-known methods that very big companies use to manage their most sensitive passwords? (i.e. passwords that, if lost, could generate tens of billions of $ of loss)

Note: I'm not speaking about the usual login passwords for each employee, but more about the company's most important passwords / encryption keys / private keys / root passwords, etc. i.e. passwords that if lost / compromised would have very severe consequences.
Examples (well I'm sure you can help me find better examples...):

for a company like Facebook, how to keep the password of the "admin panel" where DNS records of www.facebook.com are set up?

how can a company like Coinbase keep the private keys of their cold storage accounts? (worth billions of $ probably?) If multiple people have them, the probability of someone becoming crazy and running away with the keys is high. On the other hand, if only one person has them (e.g. CEO), then when he's no longer alive, the company (and its customers' accounts) is suddenly worth 0$.

In General
There's not really one answer to this question, and I wouldn't necessarily consider "large companies" to be a distinct thing with different approaches.  Certainly, the particular companies you have named have their own way of doing things, but the people who would be best able to answer for them are employees of those companies.
As for large companies in general they vary too widely, even for "tech" companies.  Some take a very top-down approach to security and tech usage, and some don't.  Some care a lot about security and many don't.  Some companies prefer building their own tools, while many prefer using 3rd party systems and not re-inventing the wheel every time.
In addition it can vary wildly inside a business.  Different departments inside the organization may have their own methods, different teams inside departments may also do things differently, and then of course individual employees may frequently do their own thing.  Again, it depends a lot on whether or not technology choices are top-down or more bottom-up.
An Example
The company I work for is a larger (~12,000 employee) international e-commerce company.  We use Single Sign On (SSO) for most everything internal, but still provide employees with an account with an online password manager.  This is intended to be used for all the other websites that employees have to sign up for in the course of their job which they cannot login to using our own SSO (AKA the rest of the internet).  The company also purchases a license for a "personal" account with the password manager for every employee, mainly in hopes that it will encourage people not to store personal passwords in their company account.
In practice usage of this varies wildly from "department" to "department", with some having almost 100% adoption while others areas of the business use it very little at all and have their own preferred methods of storing important secrets.


auditing open source compiler binaries for trojans It is a well known vulnerability that a properly altered compiler binary can transfer itself to new binaries of the compiler, and still be entirely absent from the source code.

But how real is this possibility? Has there been any attempt to audit binaries in available compilers (gcc for instance) to detect such self-replicating vulnerabilities?

It is not actually "well known". The story comes from a classic must-read article from Ken Thompson. Though it was implemented at that time as a demonstration, it would be challenging to do it on a larger scale.

The main problem here is about software updates. For the malicious binary chunk to be reinjected in the compiler, should the compiler be recompiled with itself, that code must know where, precisely, it should hook itself. And this may change between versions of the compiler. When a GCC developer makes some changes in the source code, he may unwillingly break the hooking mechanism of the hypothetical replicating virus, and he would not know it. But future changes by developers cannot be predicted, let alone be accounted for in a virus which must then work in an autonomous manner.

Or, said otherwise, succeeding at writing a piece of (malicious) code which resists more than 20 years of updates and overhauling of a software as complex as GCC, would be a remarkable engineering feat, and I doubt mankind as a whole knows enough about computers to achieve that. Yet.

In the old Thompson situation, the C compiler software was not changed, only recompiled, and that made the whole thing easy (a fun and philosophically challenging eye-opener, but still technically easy).


encoding of optional NULL in DER In PKCS1 there's DigestInfo:

  DigestInfo ::= SEQUENCE {
      digestAlgorithm AlgorithmIdentifier,
      digest OCTET STRING
  }

AlgorithmIdentifier is defined in RFC5280:

   AlgorithmIdentifier  ::=  SEQUENCE  {
        algorithm               OBJECT IDENTIFIER,
        parameters              ANY DEFINED BY algorithm OPTIONAL  }

PKCS1 provides DER encodings of DigestInfo for various hashing algorithms on page 43:

   1. For the six hash functions mentioned in Appendix B.1, the DER
      encoding T of the DigestInfo value is equal to the following:

      MD2:     (0x)30 20 30 0c 06 08 2a 86 48 86 f7 0d 02 02 05 00 04
                   10 || H.
      MD5:     (0x)30 20 30 0c 06 08 2a 86 48 86 f7 0d 02 05 05 00 04
                   10 || H.
      SHA-1:   (0x)30 21 30 09 06 05 2b 0e 03 02 1a 05 00 04 14 || H.
      SHA-256: (0x)30 31 30 0d 06 09 60 86 48 01 65 03 04 02 01 05 00
                   04 20 || H.
      SHA-384: (0x)30 41 30 0d 06 09 60 86 48 01 65 03 04 02 02 05 00
                   04 30 || H.
      SHA-512: (0x)30 51 30 0d 06 09 60 86 48 01 65 03 04 02 03 05 00
                      04 40 || H.

If I create do asn1parse on one of those DER encodings (sha512) I get the following:

    0:d=0  hl=2 l=  81 cons: SEQUENCE
    2:d=1  hl=2 l=  13 cons:  SEQUENCE
    4:d=2  hl=2 l=   9 prim:   OBJECT            :sha512
   15:d=2  hl=2 l=   0 prim:   NULL
   17:d=1  hl=2 l=  64 prim:  OCTET STRING

algorithm is denoted by OBJECT and parameters is denoted by NULL. My question is...

If parameters is optional why is NULL present at all? Why do the strings provided in PKCS1 correspond to the above DER encoding instead of, say, this one (without the NULL)?:

    0:d=0  hl=2 l=  79 cons: SEQUENCE
    2:d=1  hl=2 l=  11 cons:  SEQUENCE
    4:d=2  hl=2 l=   9 prim:   OBJECT            :sha512
   15:d=1  hl=2 l=  64 prim:  OCTET STRING

The information in the two cited RFC's seems slightly contradictory regarding the NULL after algorithm.

The overall definition of the structure claims the parameters attribute is optional, however in the appendix regarding the rsaEncryption algorithm specifically there is this:

-- When rsaEncryption is used in an AlgorithmIdentifier the
-- parameters MUST be present and MUST be NULL.

And similarly specific hashing algorithms:

-- When the following OIDs are used in an AlgorithmIdentifier the
-- parameters MUST be present and MUST be NULL.
--
md2WithRSAEncryption       OBJECT IDENTIFIER ::= { pkcs-1 2 }
md5WithRSAEncryption       OBJECT IDENTIFIER ::= { pkcs-1 4 }
sha1WithRSAEncryption      OBJECT IDENTIFIER ::= { pkcs-1 5 }
sha256WithRSAEncryption    OBJECT IDENTIFIER ::= { pkcs-1 11 }
sha384WithRSAEncryption    OBJECT IDENTIFIER ::= { pkcs-1 12 }
sha512WithRSAEncryption    OBJECT IDENTIFIER ::= { pkcs-1 13 }

It seems a little silly to define a field as optional but later mandate its presence and value. Perhaps there are other algorithms where the field may be omitted, but these algorithms specifically require it?

The standard does seem to get confusing in the EMSA-PKCS1-v1_5 section where it talks about optional parameters with some algorithms:

-- When id-md2 and id-md5 are used in an AlgorithmIdentifier the
-- parameters MUST be present and MUST be NULL.

-- When id-sha1, id-sha256, id-sha384 and id-sha512 are used in an
-- AlgorithmIdentifier the parameters (which are optional) SHOULD
-- be omitted. However, an implementation MUST also accept
-- AlgorithmIdentifier values where the parameters are NULL.

But the example immediately following this text includes the null:

sha1    HashAlgorithm ::= {
    algorithm   id-sha1,
    parameters  SHA1Parameters : NULL  -- included for compatibility
                                       -- with existing implementations
}

All the ASN.1 examples I looked at in the documentation appear to include the mandatory optional null. Based on the behavior of both openssl (creation) and Mozilla PKIX (validation: https://hg.mozilla.org/mozilla-central/rev/08032b8280c6) the nulls-after-algorithm appears to be the generally accepted interpretation of the documentation, even though its required presence could be argued based on the original structure definition and the null does not appear to add value.

Update: I came across a posting on the OpenSSL mailing list https://mta.openssl.org/pipermail/openssl-dev/2015-January/000441.html that actually discusses this same issue, and the interpretation logic seems to be summed up (with some history) as follows:

... declaring that in this particular case (optional parameters of
AlgorithmIdentifier) NULL is equivalent to (the same as) absent. In fact,
RFC 5754 (page 4) states that the correct encoding is omitting the empty
list altogether, but some uses defined their encoding as NULL, and it’s OK.
It reveals some history of this duality:

The two alternatives arise from the loss of the OPTIONAL associated with the
algorithm identifier parameters when the 1988 syntax for
AlgorithmIdentifier was translated into the 1997 syntax.  Later, the
OPTIONAL was recovered via a defect report, but by then many people
thought that algorithm parameters were mandatory.  Because of this
history, some implementations encode parameters as a NULL element
while others omit them entirely.


Apple FileVault -- would Apple build a backdoor? Could Apple build a backdoor into it's FileVault encryption technology? Is that a risk you take of using a closed-source encryption product in general? Would using something like TrueCrypt be more reliable?

I would be less worried about a backdoor than sheer weakness as an encryption scheme. This article appeared in February this year and was the first thing that came up when I typed "decrypt filevault" in google:  http://reviews.cnet.com/8301-13727_7-57369983-263/filevault-2-easily-decrypted-warns-passware/

You should check out TrueCrypt, as they are evidently purely devoted to mac disk encryption. Probably any non-costly or self-made system will be reversible in the right hands, partly due to the fact that the decrpyter would be smart to assume one of those methods (free or supplied with the operating system) were used, which is essentially removing one variable in the search for the decryption key.


How unlikely is it that a Google Doc link is guessed? Most (if not all) of us know that a Google Doc link looks something like this:
https://docs.google.com/document/d/13P3p5bA3lslqEJT1BGeTL1L5ZrQq_fSov_56jT9vf0I/edit

There are becoming several tools (like Trello) that allow you to "attach" a document from your Google Drive. When you attach a document, you have to manually go in and add people to the document - or say that anyone with a link can edit, view, or comment.

From a security standpoint, how risky is just saying that everyone can edit? What is the likelihood that someone could brute force guess your Google Doc link, and thus gain access to your document?

My guess here is that there are a  lot easier avenues (e.g. guessing someone's Trello PW, rubber hose decryption) to gain access to whatever information the attacker was looking for, mainly on the obvious fact that there are a lot of characters there, plus the assumption that Google probably keeps an eye out for that sort of sneaky behavior...

But let's say that you were able to brute force the links - what are the vulnerabilities with this approach?

Assuming the document ID distribution is uniform and unpredictable, here's the math:

44 characters long
Uppercase, lowercase, digits and underscore =
26 + 26 + 10 + 1 = 63 character alphabet

Therefore:
Total possible combinations: 6344
keyspace: 263 bits  ⇐ 44 * log2(63)

And we know that brute-forcing a 263-bit key in any reasonable amount of time (lifetime of the universe) is well beyond what the laws of physics will allow, no matter how advanced and magical and "quantum" the computers may become.

This may seem a bit bold an assertion, but it comes from the fact that the sun simply doesn't put out enough energy in such a timeframe to count that high. See page 157 of Schneier's Applied Cryptography for the details, or look at this answer here where I summarized the math, or this answer where lynks quoted the entire section from Schneier's book.

Specifically, the sun's energy is only sufficient to count to 2187 per year, meaning it will take 276 years with our own sun, 275 years if we could harness 2 suns, etc. You might barely have enough power to count to 2256 if you were to power your computer with the supernova destruction of every star in the Milky Way Galaxy. So that's getting somewhere.


Youtube.com trying to extract HTML5 canvas data: is Youtube trying to fingerprint users' browser? While trying to watch a Youtube videos using Tor browser, the Tor browser opens an alert window:

This website (www.youtube.com) attempted to extract HTML5 canvas image data, which may be used to uniquely identify your computer.

Should Tor Browser allow this website to extract HTML5 canvas image data?

Screenshot: http://imgur.com/aPTdy7k

Answering no will prevent the video to play.

Is Youtube trying to fingerprint visitors? What can we do to watch Youtube  videos without allowing HTML5 canvas extraction?

Likely not, but you can never be sure.

First, why does a website "attempted to extract HTML5 canvas image data"? The HTML5 canvas element allows manipulations of 2d images with Javascript. Among many other operations, it can draw images or videos to the canvas and then manipulate them on a pixel-by-pixel level. While there are lots of legitimate uses for this, it can also be used to detect subtle differences in how different web browsers render images, videos and text to gain information about the users web browser. That information can then be sent back to the server.

Youtube includes quite a lot of Javascript code, and most of it is heavily minified. That makes auditing it next to impossible. But I found 4 cases of the .getImageData function which is used to extract canvas data in the file base.js.

a=a.o.getImageData(c,d,e,f).data;for(b=0;b<a.length;+=4)if(255<a[b]+a[b+1]+a[b+2]+a[b+3])return!0;return!1

This appears to check the overall brightness level of a part of the image and detects if it is "bright" or "dark".

f=e.getImageData(0,0,b,c),k=b*c,l=0;l<k;l++){var m=4*l;f.data[m]=f.data[m+1]=f.data[m+2]=Math.floor(35*Math.random());f.data[m+3]=255}e.putImageData(f,0,0);

This replaces the whole image with random gray noise and writes it back to the canvas. I suspect it's part of the code which creates the background for the "this video can not be displayed" error message.

b=b.getImageData(0,0,1,1).data;return b[0]==b[2]&&b[1]==b[3]

This part of code appears twice. It checks if the first pixel of the canvas is a greyscale color.

None of these snippets looks suspicious and appears to be plausible use of this feature in the context of a video player. But taking a glance at the minified mess this is and how much code there is, it is hard to be sure that there is no situation in which it leaks any information to a server. Also, just because I got Javascript with just these 4 cases, it doesn't mean that you will get the same. They could sent different javascript to different users depending on a million of variables.


Central Authentication Server for SSH and Web wanted I have many client devices that I need to reverse SSH tunnel into. I am finding that managing all these certificate files are becoming cumbersome. I am looking into a centralized authentication system.

I am also running a NodeJS server that first checks REDIS for proper authentication then saves sensor data to Mongo.

Is there a more scalable and unified technique for managing authentication of webservers and SSHD?

I think you should look at OpenSSH Certificates. With certificates you can have one central key (the CA) to give access to multiple servers. There is multiple guides out there on how to do this.

Here is one from digitalocean: https://www.digitalocean.com/community/tutorials/how-to-create-an-ssh-ca-to-validate-hosts-and-clients-with-ubuntu

I have also written a guide on how to do more fine grained access control using ssh certificates:
https://framkant.org/2017/07/scalable-access-control-using-openssh-certificates/


TCP Peer unexpectedly shrunk window messages in dmesg log We get quite few messages like these in our dmesg log on various servers:

TCP: Peer 0000:0000:0000:0000:0000:ffff:d431:5861:56369/80 unexpectedly shrunk window 2522304441:2522312601 (repaired)
TCP: Peer 192.162.164.1:33760/60908 unexpectedly shrunk window 3159965547:3159965552 (repaired)

I have been told that these are denial of service attack on our infrastructure. If you can keep the TCP connection open indefinitely you can tie up system resources and stop legitimate clients from being able to connect to your servers.

How could I actually identify if these are and actual DOS attacks or some thing a lot less harmful?

en.wikipedia.org/wiki/Sockstress
tcpipguide.com/free/t_TCPWindowSizeAdjustmentandFlowControl.htm

This normally occurs when a client decides to reduce its TCP window size, without the server expecting it. This can be the case when fragmentation is an issue, or when the client is using an embedded device with very little NIC buffer memory. This is a completely normal behaviour, and you're likely to see quite a few such packets in your log. The messages are informational only, and are used to debug networking issues.

I'd be worried if you saw hundreds of thousands of these packets, since there are attacks that involve packet fragmentation and small window sizes, but otherwise it's just the normal sort of noise you should expect to see on any internet-facing network. In fact, the "repaired" part of your message is showing that your network driver fixed the issue, which is usually done by concatenating the payloads of two fragmented packets together. Shouldn't be an issue at all.


How does the attacker discover our server? As titled, we discovered some unknown IP address is accessing our API Server.

We have set up an AWS EC2 instance as an API server. The API server URL is only used in our mobile app.
However, our mobile app has not been released yet and the API server URL is not linked from any public website.

We can see the (multiple) attackers are randomly trying the URL path,

i.e.
/admin/i18n/readme.txt
/a2billing/admin/Public/index.php
/current_config/passwd
/recordings/
/.git/objects

How do they discover our server really?

The short answer is that many people are scanning everything most of the time.

Doing so was, some years back, considered impractical, but the combination of better networks, better tools better throughput, and more of the space being in use means that is no longer the case.

For example, Zmap claims on its front page:

  ZMap is capable of performing a complete scan of the IPv4 address space in under 5 minutes, approaching the theoretical limit of ten gigabit Ethernet.

Botnets tend to distribute the same sort of scan across significant numbers of nodes, to achieve a similar result: any given machine on the internet is likely to be scanned at least once a day by a determined attacker/scanner.

Once a webserver is identified on a given IP, there are all kinds of tools to test well-known paths, and tools that will try and guess at your sitemap.

In short, welcome to the internet - where obscurity is not security.

Do consider this in the context of setting up your app/services/widget - in all likelihood, things you would probably prefer to be 'secret' will not be, and defending your assets and resources is necessary.


How do I map all active wireless devices inbound? In any residential building, there is a multitude of WPA2-protected wireless access points.
Yesterday I was at a friend's and attempted to launch aircrack-ng against their AP (with permission). I was assured that there is a linux laptop currently connected. However, I was unable to acquire the device's MAC, to pass to aircrack-ng.
I would like to acquire a list of all wireless devices inbound, with their respective MAC and IP. If this is possible. I do not have the WPA2 password.
I know that the first step is to put my network card in monitor mode.
# airmon-ng <start|stop> <interface> [channel] or airmon-ng <check|check kill>
sudo airmon-ng start wlan0 2

As a second step, I attempted iwlist scan. However, this returned only a list of AP-s, that is, devices in Master mode.
Is there some communication between a connected device and the respective AP if no services are running, just to keep the connection alive? How do I monitor this traffic?
Can I use something line tcpdump wlan0 to do this? If yes, how can I get the MAC data out of the packets?

You are searching for airodump-ng (interface) !

Main steps in short:

1) Put monitor mode

airmon-ng

2) Dump (This step is what you are searching for)

airodump-ng mon0

3) Generate some traffic

aireplay-ng

Wait for the handshake.

4) Crack it with a list

Use the John the Ripper as word list to crack the WPA/WP2 password.

aircrack-ng -w /pentest/passwords/john/password.lst wpacrack-01.ivs

Here is the full description! (I assume you use BT)

backtrack wep crack

HOWTO : WPA/WPA2 cracking with Back|Track 5


SUID exploit and patch I am working on a SUID root binary "app" that runs a system("ls -la /dir") command. I managed to exploit it by writing a malicious replacement ls that starts a shell, and changed my user's $PATH such that the malicious ls executes instead of the one in /bin.

I noticed that executing it as user returns a root shell while executing it with sudo "./example" uses root's path and simply lists the files in dir. As far as I know, setuid inherits owner's (in this case root) privileges to user and sudo executes as root.

What are such vulnerabilities called?
How would an app developer patch it?
Is there any way I can force users to use sudo ./app to execute a program?

**the binary is a statically linked executable

Tricking a program with more privileges to do something that the owner of the program didn't intend is called privilege escalation.

When a privileged program reads data from the outside, it should verify that this data is harmless. This is called data sanitization. For example, a setuid program that executes an external program should verify that the program it's executing is the intended one. In this case the program depends both on the comamnd string ls -la /dir and on the value of the PATH environment variable¹. The only safe values for PATH are those such that the first entry for ls and any other command that the program might execute is the intended one; in practice that means completely ignoring the external information (the value of PATH in the environment) and setting PATH to a known safe value.

Sudo removes most environment variables, including PATH which it sets to a safe default. This makes it easier to write safe privileged components by using sudo rather than a custom setuid program for privilege elevation. A program run through sudo starts up with a safe value for PATH. You can still get things wrong, of course. For example allowing a user to run sudo ./example allows them to run whatever they want since they can create an executable called example in the directory of their choice.

¹  And LD_xxx variables used by the dynamic linker, but the dynamic linker of the setuid program wipes those when it sees that the program it's linking is setuid.


Is it possible to use one-time passwords for WI-FI? Is it possible to configure an access point to use one-time passwords for authentication and encryption ?

You could configure the access point to use WPA2-Enterprise and then configure your radius server to use OTP as a password.

This would mean the user enters the OTP as a password. One thing to note, is that the client does not know its a OTP and might save the profile (which will not work next time since the OTP is spent), thus causing headaches for the users.

One thing im curious about: Why use OTP for Wifi at all if its not for hotspot payment?
A better idea would be to use a general group password to access the hotspot and the internet, but when you want to access other services (for example, internal servers, intranets, secure storage etc(, you have to authenticate to a webpage to gain access through a firewall.


Content Security Policy https: and data: meaning I am having trouble finding information on the implications of using https: and data: as a source
for the directives in a CSP.
Example:
img-src 'self' https: data:;

Could someone some context around what these two sources mean and if there are security issues with using them like this?

Content-Security-Policy: img-src 'self' https: data:;

I would read that out loud as "images can be loaded from the current domain, or any https:// url, or are data:// url".
So having https: basically means that images can be loaded by reference from any 3rd party website. In this day and age, that's basically all websites. So that sorta defeats the purpose of having this directive in the first place.
data: is a bit more subtle; this is intended if you want to embed an image directly into an HTML document; ie you don't want the page to make an external GET to fetch the image. W3Docs give this example which is the data for a 5x5 pixel red dot.
<img src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAUAAAAFCAYAAACNbyblAAAAHElEQVQI12P4
  //8/w38GIAXDIBKE0DHxgljNBAAO9TXL0Y4OHwAAAABJRU5ErkJggg==" alt="Red dot" />

Embedding an image of any reasonable size will be much larger, for example here is my StackExchange avatar (some random site, not sure if this link will go dead at some point).
So again, allowing data: kinda defeats the whole point of this CSP directive.

What's the point of CSP: img-src anyway?
Content-Security-Policy is generally viewed as a second line of defense against XSS; say an attacker has found a bug in your UI that lets them inject arbitrary javascript into the page that users load; having a tight CSP on your page can sandbox what that malicious javascript can do.
I think the point of the img-src directive is to prevent:

Website defacement: embedding images into your page that are unprofessional, lead to phishing, or otherwise damage your website.
Exploit vulnerabilities in a client's image parser. Historically there have been, for example, buffer overflows in the Android media parser, and an attacker may be embedding a crafted jpeg on your webpage with the goal of taking over devices of your users.

You'll have to decide for yourself whether the legitimate functionality of your website needs the UI client to be able to load images from arbitrary https URLs, or to directly embed data: encoded images, but if you don't, then you should probably take out those CSP directives in order to maximize the protection you're getting from your CSP.


What do you call an attack vector that consists of filling the whole server RAM using a single process? I’m aware of several attack method names, such as fork bombs or csrf, but how do you define an attack that consists of making a single request to fill the whole server ram with a single process? That is, making the server spend its time managing swap and nothing else.
I know this is dos, but I want the precise name (for example fork bomb is a dos method). Anyway, I’m sure it is a common vector and I need specific documentation to it in order to convince someone letting a process filling the server ram with normal use isn’t an intended functionality. (If I have a name then finding something like a wikipedia article will be easy)
I couldn’t find anything similar anywhere.
Update
The case is about sending millions commands in a single git push over a zlib enabled ssh channel. (commands are queued in ram and start to be processed when all of them were received)

The very generic name for such an attack is a Denial of Service (DoS).

I guess more specifically it would be a RAM exhaustion attack vector. The best fit would probably be Uncontrolled Resource Consumption ('Resource Exhaustion').

Even more specifically it could be a flood attack:

  Defining feature of floods is that the DoS effect only lasts while the
  flood is active, although some systems may keep allocated memory
  forever or crash when memory/CPU get depleted.

The article mentions flooding the server with requests, however depending on the system one such request may be enough to eventually fill RAM.

Without knowing exactly how the memory is being exhausted, it is difficult to come up with a more specific name for this.


Trying to learn bug-bounties, how do I use the practice sites like hackthissite and hacmebank? Do I just attack those sites while they're live, or is there a way to download the site to attack offline?  The reason I'm curious is because if those sites are vulnerable and being used for practice all the time, wouldn't multiple hackers interfere with one another?

What I've seen in the various learning resources I've been to is just, "go practice on these sites", but no explanation as to the process by which you do that.

The answer to this generally depends on the tool. There are some practice targets that can be deployed and attacked locally and there are some that are hosted in the cloud. By and large, these tools aren’t exactly giving a sterile environment (especially the cloud-based ones). This is actually a good thing, as targets in the wild aren’t sterile either. A lot of systems and applications can be assumed to be attacked by multiple agents at once all time anyway, so practicing with that sort of environment is all part of the training.


I have lost control of my online identity due to mistakes made decades ago. What can I do? About 2 decades ago (late 90s/early 00s), when I was still in high school, I opened up social media accounts online. Over the course of a few years and using these social media platforms, I posted personally-identifying information about myself online.

Today, an old friend contacted me to inform me that someone is stalking me and had used those ancient social media platforms to dig up real-world details about my self. Quite honestly, I find this absolutely mortifying.

I no longer have access to the social media accounts where I posted those things. I also no longer have access to the email boxes that I had tied to those accounts, and my old e-mail provider (yahoo) has 100% completely denied helping me with getting access to them.

I am an adult with a professional career in software engineering now. As I reviewed my old social media accounts, I have experienced extreme self-apprehension about my mid-teenage'ed self's online persona. The information that I posted as a kid was extremely ... well, it does not reflect well on me, nor do they reflect the world views I hold today.

I am much wiser now. I know that by posting PII online as a kid that I had unwittingly set myself up for this scenario. I didn't know better at the time, but one thing is for certain; it has to go. If this information is weaponized against me, it could be used to sink my career and relationships with people around me. And yet, I have no ability to clean up that old stuff, simply because I no longer have the account credentials required to do so.

Short of changing my name and moving across the world to take on a new identity, what can I do to prevent/mitigate the damage that a malicious third-party could do if they weaponize my info?

You may have legal avenues that you can leverage, based on the which country you reside in.

If you live in a country that is part of the European Union or United Kingdom (GDPR still is applicable in the UK), you could try to leverage the use of GDPR (General Data Protection Regulation).  Basically with GDPR, you have a legal right to request the erasure of information that you deem is personal information about you on the internet.  It basically can be inferred as the right to be forgotten, however there are a few exceptions.

If you live in the state of California in the US, according to California Civil Code §§ 1798.100 through 1798.198 (California Consumer Privacy Act (“CCPA”)), you also have the legal right to ask for the removal of personal information.  There are exceptions to where the CCPA does not apply.


Clarification of PCI DSS 3.1 requirement 6+8 I'm quite puzzled about the PCI requirements when it comes to session timeouts and scope definitions.

The login is the end user/customer login to the public facing control panel in which they can handle their own transactions. We act as PSP. The customer cannot see card numbers and expiry dates. They can simply capture already authorized payments and make subscription payments.

Requirement 6.5.10 states:

  Incorporating appropriate time-outs and rotation of session IDs after a successful login.

Requirement 8 note states:

  Note: These requirements are applicable for all accounts, including point-of-sale accounts, with administrative capabilities and all accounts used to view or access cardholder data or to access systems with cardholder data. This includes accounts used by vendors and other third parties (for example, for support or maintenance)

And requirement 8.1.18 states:

  If a session has been idle for more than 15 minutes, require the user to re-authenticate to re-activate the terminal or session.

So my question is; does requirement 8 apply to the public facing web interface for customers (meaning that an appropriate timeout could be e.g. 60 minutes instead of just 15) or does it only apply to administrative access to the systems e.g. via SSH or an internal web interface only accessible by employees in scope.

15 minutes is a very short amount of time for session timeouts for our customers which are often web shops who handles orders as they come in. They need to log in over and over again during the day, since they do all their payment handling through our end user interface and not via the API.

The idle timeout does not only apply to administrative accounts or internal accounts.  It applies to:

  all accounts, including point-of-sale accounts, with administrative capabilities and all accounts used
  to view or access cardholder data or to access systems with cardholder data. This includes accounts used by vendors and other third parties (for
  example, for support or maintenance).

https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-1.pdf


Why does "keytool.exe" with "-certreq" arg require an alias? I'm using the "keytool.exe" JDK utility to try to create a CSR (Certificate Signing Request) with the "-certreq" arg.  Was wondering why this requires an alias (i.e. of another cert in the keystore) when I haven't even gotten the cert back yet from the CA (to whom I'd send the CSR).  I understand that it could be used to marry the signed cert w/ an existing key pair/self-signed cert, but what I want to do is (to create a new cert):

Generate a CSR to send to CA ("-certreq" arg).
Upon receipt of signed cert, gen a new key pair ("-genkeypair arg)" w/ new alias.
Import my new cert against that alias from #2.

My contention is that I shouldn't need an existing keystore entry/alias for step# 1.  Do I really need some dummy self-signed cert in the keystore 1st?  Thx!

A certificate for a CSR is the public key of a key pair plus some metadata.  You are effectively asking a member of the trusted public key infrastructure to "vouch for" your public key as coming from you.  Once the metadata has been validated by the authority, they will issue you a certificate with your public key that is signed by the authority.

Once you have a signed certificate, follow the Oracle documentation to merge it into your keystore with your existing key pair: https://docs.oracle.com/cd/E19509-01/820-3503/ggezu/index.html.  This will overwrite your unsigned public key in the store with the signed version from the issuing Certificate Authority. (thanks Maarten Bowedes)

The authority is signing the public half of your original key pair as coming from you.  If you generate a new key pair and overwrite your alias you will effectively be writing over the private key associated with your (now valid) certificate.


Does Apple supply hardware keyloggers? I received a brand new Mac laptop for work that is basically ours and doesn’t have to be returned, even after quitting. It was inside the box and sealed. I was wondering if Apple supplies and installs hardware keyloggers. The Apple manafacturers are the only ones with physical contact with the laptop. Is that possible? Otherwise, I know about DEP (Device Enrolment Program).

There is no evidence that Apple has ever installed a hardware keylogger into any of their products. I can find no reference to such a feature or option existing or being advertised, either for consumer or commercial purposes. Further, it seems highly unlikely that a hardware vendor would embark on such an ethically questionable course of action against their own products and customers; it would reflect exceedingly poorly upon them.

This is not to say that a company could not have installed keylogging software after they received the laptop. However, I find it hard to believe that they would install a hardware keylogger - for a start, modern MacBooks are difficult to disassemble without damage. In this situation, formatting the disk and re-installing the OS should be sufficient to ensure that the device is clean.

DEP is a confusing acronym here; I suggest against using it as for 99% of cases it refers to Data Execution Prevention, which is an exploit mitigation in most operating systems. I'll assume that you're referring too Apple Device Enrolment Program.

ADEP is a mobile device management (MDM) solution. Organisations can indeed use it to deploy any software they like to their devices. If you re-install the operating system, however, the ADEP settings and deployed software packages are not carried over and the enrolment stops working for that device.


Someone used my email address in order to access an online account A few days ago, I got an email reporting that one of my online accounts has been accessed by a new IP Address.
Someone used my email address and the account's (quite strong) password to access the online account.

I've checked whether my email address has been compromised using these websites:
https://haveibeenpwned.com/ and https://hacked-emails.com/
and apparently my address has not been compromised.

How is this possible to know how someone got an access to my email address?

Should I change my email's password? Should I change an email address?

Definitely change your password, no matter what.

are you sure the email you received is legitimate? Or could it have been spoofed somehow?
if you can review logins, then check if what you see is what the email says
is there an explanation involving your own activity? Did you use a new network, your phone, something else, which you don't normally do?
could this be a matter of your connection having changed IP (possible if your were on a consummer-grade ISP) - and if so, do you still have that IP?
could this be a case of your re-using a password, for example between your.name@compromised.com and your.name@youremailprovider.com)?

If you can enable 2 factor auth, do so.

You might also consider using something like KeePass if you don't already, and go around to change all your passwords to something totally random, and unique per service.


If I put encrypted data in core data on iOS or macOS, how could a hacker crack it? Suppose I made an app that allows a user to enter plain text, and encrypt it with a password. Then the app stores the cipher text in core data. The user can select a "file", enter that same password to decrypt it, then view the plain text (but hopefully not the cipher text). If the wrong password is entered, the app will not attempt to decrypt the cipher text.

How could one acquire and view the cipher text? Is it possible? I would expect this to be a major help to one trying to discover the algorithm or decrypt the cipher text.
How could one alter the cipher text so that they could attempt to decrypt it in order to learn more about the algorithm? Is it possible to alter an app's core data without using the apps built-in update functions?

Assume that neither the password, the plain text nor the cipher text is sent over a network.

I expect I should provide more details. Just let me know.

Cryptography can be used to protect against tampering even with offline attacks. Modern cryptography which doesn't detect tampering and relies on secrecy of its algorithms should be considered broken and is essenatially useless. A modern cryptosystem (say , AES-GCM) uses completely public algorithms , is resistant against differential cryptanalysis and tamper-proof with offline access to the ciphertext.


How to know which secret key to use to create and verify JWT We have several websites where users have to log in. For each website we want to support a single signon solution based on JWTs (JSON Web token).
There are also several (other) websites that can act as Identity Provider.

When the user accesses our website and is not authenticated, he can choose which identity provider he wants to use. The identity provider sends a JWT claim which in its simplest form says

 { "username": "john.doe" }

This is (hmac) signed with a shared secret so our website can check the authenticity of the claim.

In my situation a website can support multiple identity providers and an identity provider can work for multiple websites. All combinations have unique shared secrets.

My question is about how an identity provider can know which shared secret to use as it supports multiple websites. Would it make sense to request the identity with https://idp1.example.com?aud=mywebsite.com where mywebsite.com is the website asking for identification.

The other way around I have a similar problem: when mywebsite.com receives a JWT how can it know which secret to use for verification. Would it make sense to ask the identity provider to include "iss": "idp1.example.com" which can be used by mywebsite.com to find the secret to use?

All of these details have been worked out in OpenID Connect. I would strongly suggest implementing that (or using an existing implementation) rather than inventing your own protocol.


ROP Gadgets from executables? I noticed that exploits which use Return Oriented Programming always find the gadgets in libraries. I wonder if it is possible to use gadgets from the executable (.exe) itself?

I believe the reason is "it's easiest to use instruction sequences from the libraries, because the libraries are so common and they've already been scanned."

There are just a handful of Microsoft-provided C-runtime library files.  If they provide a complete enough instruction set, why work harder?


Do security questions subvert passwords? Do security questions subvert hard to crack passwords? For example, if a site requires passwords with a certain scheme (length + required character sets) and has a security question, why would someone try cracking the password instead of the security question? I assume most answers to these are shorter and have a smaller variety of characters. For example, "Mother's Maiden Name" (somewhat common question) is typically not as long as a decent password (even after satisfying password requirements) and often contains only letters. When a site requires a security question, is it best to fill it in with a lengthy string containing random characters?

The manner in which security questions are used by a site, determines whether they undermine the supposedly stronger authentication mechanism (of using good passwords).

Typically, systems that allow access to users after they've answered a security question, are weaker than systems that would communicate a (temporary) password to the user via a (different and secure) channel. The previous statement conveys a best practice, and certain systems need not implement all of it; some systems would provide a new password (which need not be changed by a user), and there are other systems that would communicate the password via an insecure channel.

Filling a security question with random characters is not necessarily a good approach (although it is better than having a smaller answer with low entropy), for it would make it difficult to remember, resulting in a potential lock-out scenario (from where this is often no point of recovery). It should be remembered that security questions are often not changed periodically unlike passwords. The answer therefore depends on how well the answer is protected (both by the user and the system), how public the answer actually is, and how frequently can the question (and answer) be changed.

Reading this related StackOverflow question is recommended, for the answers discuss out-of-band communication, amongst other issues like the potential lock-out scenario.


Do sudo and .profile/.bashrc enable trivial privilege escalation? First of all, let me mention that I’m assuming a configuration as set up by current Linux desktop distributions (e. g. Debian, Fedora). I’m sure that there are methods which, if implemented, would mitigate the issues described here. What I’m interested in is the security “out of the box”.

It seems to me that the fact that shells execute files like ~/.profile or ~/.bashrc, which allow complete manipulation of a user’s execution environment and are owned by the user, destroys any hope that a program like sudo can be run securely. The problem is that any malicious program running as the user can edit these files to, for example, modify the PATH environment variable to include a fake sudo executable, such as PATH="$HOME/.evil:$PATH", where the malicious program also created a file $HOME/.evil/sudo. Then, the next time the user types sudo in a shell, the fake sudo will be run instead and can record the typed password. Thus, the fake sudo can obtain root privileges even though the original malicious program only had user privileges.

In fact, the default .profile file created by my installation of Ubuntu includes the following lines:

# set PATH so it includes user's private bin if it exists
if [ -d "$HOME/bin" ] ; then
    PATH="$HOME/bin:$PATH"
fi

so there is no need to even modify .profile – just create $HOME/bin/sudo and it’s already first on the PATH!

My point is not that it is already “too late” when arbitrary malicious code is run or that this attack could be noticed by the user (I suppose it is similar to a phising attack). I expect that a malicious program running as a user can do anything that the user could. What I would not expect is, however, that it can do more than that user (root privileges).

My question is, in essence:

Is it true that the system sudo executable can be circumvented in this way?
Why are desktop Linux systems, by default, set up in such an easily exploitable way? Shouldn’t the default way to invoke sudo make sure that it is, in fact, the executable provided by the system (nobody is going to type /usr/bin/sudo every time)? Since sudo performs system-critical security operations, the possibility to shadow its location using the PATH variable seems to bring a lot of risk with little benefit. In such an environment, it seems that using sudo is fundamentally insecure and one would be better off enabling login as root and logging in on a separate TTY.

Anything you can do on a compromised account, an attacker can do as well.

Fundamentally, this is because Linux providers isolation between users, not between individual processes running as the same user. Any process running as a given user is considered to have equivalent capabilities as any other processes running under that user.

  Is it true that the system sudo executable can be circumvented in this way?

Yes, and in other ways as well. If you elevate privileges to root on a compromised unprivileged account, you compromise root. If you drop privileges from root using su to an unprivileged account, you also compromise root! You can never safely elevate privileges on an untrusted account. While it's possible to exploit the system using PATH, it's also possible to hijack the bash process itself to sniff key input. Disabling execution with noexec is further not useful because interpreters (bash, python, perl, etc) will still run. The noexec option is not and has never been designed as a security feature, despite it being regularly peddled as such.

An incomplete list of ways an attacker could hijack the use of sudo or su:

Using the LD_PRELOAD variable on the parent process (e.g. bash).
Hooking the parent process with ptrace() or process_vm_writev().
Sniffing or injecting keystrokes into the terminal emulator using the X11 protocol.
Creating aliases or functions to wrap the actual sudo executable.

I explained these in more detail on my answer to another question.

  Why are desktop Linux systems, by default, set up in such an easily exploitable way?

Elevating privileges on an untrusted account is not something you are supposed to do. Not to mention, desktop Linux is an afterthought in the grand scheme of the general *nix architecture. It is a failure of security theater incessantly repeating the same bad advice, not a failure of the security architecture of Linux itself. People repeatedly say to use sudo for root because many new users will instead run everything as root, even their browsers! In this case, it is better to be using sudo. It is harmful in the case where the user is already smart enough not to use root for everything.

Note that sudo is highly configurable and can be designed to allow only certain commands. This is where it really shines. You can configure sudo to only allow you to run apt-get update as root (with or without a password), and deny everything else. That would additionally restrict an attacker from doing anything other than... well... doing a software update.

It's important to remember that, even if you configure it to only allow running certain commands as root, you can still shoot yourself in the foot if you whitelist programs that are not designed to run as root via an untrusted user. I saw a real-life example of someone trying to run VeraCrypt in this way and explained why it is insecure. The idea was that VeraCrypt is safe to run as root, so it should be safe to use sudo to elevate it to root as an untrusted, unprivileged user. It turns out the idea is flawed, and allows trivial privilege escalation!

  Shouldn’t the default way to invoke sudo make sure that it is, in fact, the executable provided by the system (nobody is going to type /usr/bin/sudo every time)?

Typing the full path will not protect you! You can easily create a function that contains a leading /, and it will override the real executable. Even if the executable did make sure that it is genuine and attempted to defeat sniffing, a malicious process could hijack the bash process and sniff keystrokes independently of sudo, making it impossible to detect from its point of view.

$ function /usr/bin/sudo { echo 'hijacked!'; }
$ /usr/bin/sudo id
hijacked!

  In such an environment, it seems that using sudo is fundamentally insecure and one would be better off enabling login as root and logging in on a separate TTY.

This is always the case. Note that even logging into another TTY is not perfectly safe. You should use SAK, the Secure Attention Key combination, to ensure that you are interacting with a genuine login session (agetty or logind, for example). SAK is a key combination that the kernel listens for (and thus cannot be repressed by userspace). When it detects it, it will kill every process in the current TTY, triggering the login prompt to appear. If you have switched to a genuine, uncompromised TTY, then it will only cause the prompt to disappear and reappear. If you are on a hijacked TTY, it will kill the malicious process and bring back the genuine login prompt.


How completely wipe information of overwritten files and folder? I have only a basic understanding of how files are written in a hard disk. Here I assume the files are overwritten this way.

File A is deleted
Its address is removed and showed vacant
New File B is overwritten above the space of File A

I am assuming here that even though we are deleting File A and overwriting with File B, we can still recover File A with its residual information using powerful software or instruments.

I have an idea to remove this residual information. Lets assume we have an imaginary hard disk with 10 GB space in which 5GB is filled with files and  the other 5GB is empty. Then we select all the 5GB files in the hard disk then Ctrl+X (cut) it and then Ctrl+V (paste) the same files in same hard disk. Performing this operation for n number of steps thus overwriting it again and again. Will this completely wipe the residual information?

You have to stop thinking about this on the file level. For a storage device, all that matters is the sector. If one sector on a hard drive* is overwritten, the data in it is gone for good. There is no known way to retrieve it even with "powerful software", and there is no need to overwrite the same sector multiple times. Modern hard drives encode data in such a dense and complex format that a single overwrite will invariably make that data irretrievable (we can't even recover data from an old fashioned low-density audio cassette tape!). However, whether or not filling up a bunch of free space on a hard drive will actually overwrite the sensitive sectors is another matter. Due to features such as damaged sector relocation, and due to the behavior of the specific filesystem, it is not possible to guarantee that free space has been overwritten without overwriting the entire drive.
Filesystems are incredibly complex, and they are far more than flat databases of files. Cutting and pasting a file for example does not do anything but move it, which involves changing only a few bytes in filesystem metadata, regardless of how large the file is. So what about deleting a file and then filling the free space with dummy data until the drive is full? That might work, but it might not. Many filesystems contain redundant copies of information. The filesystem ext4 for example can keep copies of small files in its journal, which does not get overwritten when you wipe free space.
The exact way of storing new files is also more complex than what you have mentioned. When you delete a file, you are deleting a reference to the file (as you have surmised). However, creating a new file does not guarantee that you will be overwriting the sectors that made up the previous file. A new file will likely be strategically placed at an address on the hard drive that minimizes access latency, or which decreases fragmentation. The file may not even be deleted, but simply hidden, in order to make undeletion and incremental backups ("snapshots") possible. A new file will not simply be stuffed into the newly unallocated space in all but the very simplest of filesystems.
* When I say hard drive, I mean a real spinning rust. Solid state and hybrid drives work differently such that, even if you overwrite the same sector twice, the physical location that the data is saved to may be different each time.

If you actually need to remove a file such that no one can recover it, you will not have many options at your disposal that preserve any other existing data on the drive. But you aren't out of luck:

If you have encrypted the file or drive, you can simply throw away the encryption key.

You can erase the entire drive, for example by using ATA Secure Erase.

You can destroy the drive from the outside using an expensive degaussing machine.

Deleting the file and then filling up free space, or shredding the file using data erasure tools (which typically get a list of the sectors that the file occupies, and then overwrites those specific sectors) will generally destroy the majority of the file, but comes with a high risk of incomplete erasure, with both the file's metadata and potentially small portions of the file remaining elsewhere on the drive.


Why is a bind shell sometimes blocked when a reverse shell is not? I understood the difference between them. The problem is I am not sure when to use each. I mean, if a firewall will block my connection to the target when I use bind shell, why the connection will not be blocked, when I send the payload again through reverse shell

In order to understand why one might work when the other might not, you need to look at how firewall configurations work.

Consider an average employee computer. Most, if not all connections, will be outgoing first. Any incoming data would be in response to an outgoing connection. As such, a simple bind shell may be blocked by the firewall. I'll illustrate this below:

                                                   I want to connect to this host
                                                   on your local network.
                                                                     \
                                      That does not seem right.       \
                                      I will block this.               \
                                        /                               \
  +----------+               +----------+                               +----------+
 /          /|              /          /|                              /          /|
+----------+ |             +----------+ |                             +----------+ |
|          | |             |          | |                             |          | |
| Employee | | <-/-/-/-/-+ | Firewall | | <-------------------------+ | Attacker | |
| Computer | +             |          | +                             | Computer | +
|          |/              |          |/                              |          |/
+----------+               +----------+                               +----------+

However, a reverse shell looks to the firewall like the employee computer is initiating the connection to some remote host, and thus may accept it. You can imagine the situation like this:

            I want to connect to
          this host on the internet.
                /
               /                 Seems normal to me.
              /                     Go ahead!
             /                               \
  +----------+                               +----------+               +----------+
 /          /|                              /          /|              /          /|
+----------+ |                             +----------+ |             +----------+ |
|          | |                             |          | |             |          | |
| Employee | | +-------------------------> | Firewall | | +---------> | Attacker | |
| Computer | +                             |          | +             | Computer | +
|          |/                              |          |/              |          |/
+----------+                               +----------+               +----------+


OCSP stapling Alice and Bob In the case of OCSP stapling in the browsers, it works this way. But my question is, in a case where I have a communication between Alice and Bob how this works? I know that if I use OCSP normal, both parties goes to the CA, but in the case of OCSP Stapling, how it works? Any example?

Thanks.

OCSP stapling is an extension to the TLS protocol which is defined in RFC 6066 and extended in RFC 6961. The client announces support OCSP stapling to the server during the TLS handshake and if the server has a OCSP response for stapling it will be send as CertificateStatus with the TLS handshake.

It does not matter who fills the role of client and server: The server might be a web server supporting TLS and the client might be a web browser as in your question. Or the server might be a mail server supporting TLS and the client a mail client. Or the server might be Bob and the client Alice, speaking their own protocol protected by TLS. All it matters is that both sides use TLS for communication and that the client requests OCSP stapling and the server provides the OCSP response within CertificateStatus.


Banking application login leaks information My question is regarding the online banking application of a large credit card organisation. The login process for this application works as follows:

User visits the homepage of the bank.
User enters their username and clicks login.
If the username exists they are presented with their unique image and phrase, chosen by the user when they sign up to the online banking application. If the image and phrase are as expected, the user enters their password.
If correct, the user is authenticated and has full access to their account, including viewing statements, paying bills, increasing/decreasing credit limits, etc.

The problem I find here is that if one knows the username of a user, they can enter this into the first stage and immediately be presented with the image/phrase combination for that account. An attacker could then easily use this information in a phishing attack against that user.

My question is:

Isn't this a large security flaw?

Addition: In response to the first answer I should add that upon providing a username which does not exist, the application responds with a "Please check the username provided" message.

Yes, this is flawed in two ways:

It allows an attacker to enumerate usernames simply by trying them and checking the response.
It allows an attacker to get your "secret" image using a non-secret piece of information. This amounts to absolutely nothing in terms of security, and is simply theatre.

On top of that, I can see another potential hole: the attacker may not even have to download the images. If all you require is a valid username, what's to stop the attacker from creating a phishing page that uses the same mechanism as the real site to retrieve the picture from the real bank's server?

The correct implementation would be to have two authentication tokens, and only show the image after one of them has been correctly entered. This is usually done via a password and "secret word", but you could equally use a strong second factor like a hardware token.


Is this design for storing/sharing secrets secure? Goals

I am implementing a web-based system which has the following goals:

Users are able to store secrets (could be password, or an entire file) on the server.
Server has no knowledge of the keys for decryption. So that if the server is compromised, the attacker would not be able to decrypt the secrets.
Secrets can be shared between users.

Design

The main threat I am concerned about for the purposes of this question is server compromise. I want to ensure that if an attacker gains access to the server or database (offline or online), no secrets are exposed. I understand there are other threats, like a compromised user account. Other safeties will be in place to protect against that.

I decided that it is safest for the server to never see a plaintext secret or the key material. Therefore, all encryption is done client-side. I am using asmCrypto.

HTTPS is used for all client/server communication. Users require accounts, there is already an authentication system in place.
Users generate a personal RSA key pair (2048-bit, e=65537). The private key is encrypted with AES-GCM using a PBKDF2-generated key based on the a user-provided passphrase. The AES nonce is generated by the server to guarantee uniqueness. The user's public key and the encrypted private key are sent to the server to be stored.
When a user saves a secret, they generates a random unique key (K) for that secret. They encrypt the secret with AES-GCM using K and a server-provided nonce. Then they encrypt K using their own public key and OAEP padding. Additionally, they may encrypt K with another user's public key. The encrypted copies of K are sent to the server.
To read the secret (possibly from another computer), a user must retrieve their encrypted private key from the server. They decrypt their private key client-side by providing a passphrase, which is fed into PBKDF2 to generate the AES key. Once their RSA private key is decrypted, they can decrypt the secret key (K), and subsequently the secret.

Questions

I know there are many pitfalls and potential gotchas with encryption. I've done a lot of reading to try to understand how best to use these algorithms (for instance, the unique nonce for AES-GCM, the value of e for the RSA keys, and the importance of using proper padding). However, I'm not entirely confident this is a sensible design.

What flaws do you see in this design?

Are the choices of algorithms and parameters sound?

Is there any way to judge the quality of the asmCrypto library?

Am I missing a simpler, obvious solution?

Issue with Trusting the Server

If you base the web-app on the server, then when the server is compromised, the base web page or the crypto library can be compromised/bypassed directly without alerting the users.

Your infrastructure is built upon a bed of sand if you cant trust the server.

Attacks:

Remove encryption totally and have the content unencrypted, the users still use the software expecting it to be encrypted, but it isnt. (complications being the current encrypted content)
Or to just send the 'secret' to the attacker directly.

The whole Javascript Cryptography Considered Harmful issue documents this and other issues. Note: That this article mentions the secure notes use case.