Does a revocation certificate leak information about the private key? Kleopatra/ GPG can create revocation certificates, which look a lot like public/private keys. Obviously, these keys should not be shared or used unless one intends to revoke their keys. But assume that the revocation certificate were not secure. Would sharing this key with the world leak information about the private key which could be used to crack it? (obviously the denial-of-service/loss of trust would be a larger issue, but that's not the point of this question)

No. It does not reveal any information, except the key id, which is revealed to anyone who has a copy of either a signature made by the key, a message encrypted to the key, or the public key.

PGP keys are commonly distributed as base64 encoded data, which is simply a way of encoding data, not specific to PGP, and is probably what you say when you say it looks a lot like private keys.

The internal data is not similar. The revocation certificate is a signature, made with the private key, and a specific content, which basically says that it's revoked. You can examine the content of it easily:

gpg --list-packets revocation.asc
# off=0 ctb=88 tag=2 hlen=2 plen=120
:signature packet: algo 17, keyid <keyid>
        version 4, created 1586130213, md5len 0, sigclass 0x20
        digest algo 8, begin of digest d5 a4
        hashed subpkt 33 len 21 (issuer fpr v4 <issuer>)
        hashed subpkt 2 len 4 (sig created 2020-04-05)
        hashed subpkt 29 len 1 (revocation reason 0x00 ())
        subpkt 16 len 8 (issuer key ID <keyid>)
        data: [256 bits]
        data: [254 bits]

As you can see, it has a signature type 0x20. If we go to RFC4880, which standardizes PGP, we can read the following about signature type 0x20:

  0x20:
  Key revocation signature

  The signature is calculated directly on the key being revoked.  A revoked key is not to be used.  Only revocation signatures by the key being revoked, or by an authorized revocation key, should be considered valid revocation signatures.


How does change.org prevent fraud? On the site change.org it's possible to start a petition.

I found two (somewhat) contradicting statements in their privacy policy:

  We do not monitor, verify, or perform any background check on campaign starters, petition signers, or other users of Change.org.

  Fraud prevention: We may use and disclose the information we collect from and about our users as we believe necessary to investigate, prevent, or respond to suspected illegal or fraudulent activity or to protect the safety, privacy, rights, or property of us, our users, or others.

They also state, that they store the IP address of users who have signed a petition:

  An IP Address may be identified and logged automatically in our server log files whenever you use our platform and services, along with the time of your visit and the specific page(s) that you visited.

From what I could gather it would be very easy to create petitions with fake users to bring attention to a petition (or to reach a certain amount).

My question is simply:

How does the site ensure that there's no voter fraud?

Short version (and obligatory IANAL*): they don't prevent "voter fraud" as this is not an official electoral system. Change.org is just some organization offering online petitions. Those petitions have no binding impact on any judiciary.

Longer version: As you have already quoted, they apparently do some kind of IP correlation analysis. This is regular fraud monitoring/detection, albeit not trivial. Low effort fraud - as probably conducted by someone who's trying to manipulate an online petition - will most likely leave some form of red flags. E.g. a large number of votes from the same IP within a short amount of time, same browser user agent etc.

As for how exactly they do it: They will most probably not disclose their exact process as this might lead to someone crafting more elaborate fraud attempts.

*I am not a lawyer

Fun fact on the side, there's even a rather ironic petition to make change.org legally binding for the UK government - with 23 whole signatures and apparently no traction whatsoever.


is the certificate signature a hash of just the public key? Is the X.509 Certificate Signature an encrypted hash of just the public key or is it a hash of more then the just the key?

The signature covers the certificate, not only the public key. If the signature covered only the public key, you could change any parameter (expiration date, domain name, issuer) and the signature would still be valid.

Digital signatures are not encryption: https://security.stackexchange.com/a/87373/70830

It is important, when reading the link above, to not skip words, sentences and paragraphs that are hard, or at least, if you did, to not then say you've read it when you have only tried and failed to read it.

Very insecure textbook RSA was explained in a handwavy form to non-specialists who did not need to implement it, in this bad way, by someone who thought it reduces the number of concepts and is thus easier to digest. The people who made this explanation were wrong in the 70s about RSA (at the very least because padding), but they are catastrophically wrong about modern digital signatures. There is no notion of encryption in DSA, ECDSA, EdDSA.

People have, in the decades since and even recently, naively implemented textbook RSA, thinking it is secure. Often, they later say something like "my math professor said I can implement unbreakable encryption by just using modular exponentiation, in some introductory math class, and I took a bignum library and just did it".

Textbook RSA is of course insecure, and if they learned about cryptography in a cryptography class, they would have been taught why.

We can't take out every math teacher (or documentation writer or blogger) who says this out back and shoot them. Because we need math teachers (and maybe even bloggers). But we really need to teach math teachers, at least new math teachers, to not talk about cryptography outside of cryptography classes that will teach people enough so they won't go out and do stupid things. Machine shop teachers understand teaching about safety, math teachers should too. But many were themselves taught in an environment that did not appreciate that there can be safety hazards in pure math. Because someone might rely on an app, a piece of math, to keep secrets that would land them in jail, or worse.

We are also getting into the general problem with updating information in people's heads and on the internet. This problem is very hard.

Often, when people  learn that something they knew is actually incorrect, they would later forget the update and keep remembering the incorrect first thing they learned. So you need to keep correcting people.

The internet keeps publishing regurgitations of information that someone learned decades ago and that now we know is incorrect, and the date of the publication is new, so a reader would not know they are reading something from the 70s that has since become wrong. So we need to keep correcting publications.

This site has many separate questions and answers that boil down to someone trying to make sense of the "signature is encryption with the private key" explanation and failing (first example that came up on google). The world is full of buggy software written by people who didn't read and understand why it's wrong.

(Thanks Steffen Ullrich for the typo fix!)


Internal IP's Probing to Unknown External IP's I recently took a CEH class and they mentioned checking for internal IP's probing to External unknown IP's to determine an attack. What would be the best way to gather and analyze these types of issues? Especially when you have a large network how do you keep track of this?

I think the best way is to use NetFlow analysis for large scale monitoring. If you have a Cisco router they have NetFlow collection built in and you can combine it with the open source tool suite SiLK for analysis https://forensics.cert.org/

NetFlow was initially developed by Cisco for billing purposes and collects none of the payload, only summary information such as:

Source IP
Dest IP
Source Port
Dest Port
Packets
Bytes
Start time
End Time
Flags
etc...

With this you can quickly analyze large amounts of data, I have one installation of SiLK using the open source NetFlow replacement IPFix from the IETF that gets 150,000 events per second.

There is a free handbook to get you started: https://tools.netsa.cert.org/silk/analysis-handbook.pdf

This would do exactly what you want and provide long term security benefits such as trending and anomaly detection.

Another option if you want to do this just one time, configure a span port on the egress point and collect data using tcpdump for a short bit. Just be sure to delete the PCAP when you are done as it may contain PII.


HTTPS is not green and there is no padlock icon, is it safe for a debit card payment? I was about to pay online with my debit card, but now I'm not sure, is it safe ?

Note: this question is a few years old and browsers are changing how they report issues with secure sites over time.  The below answer still describes why some problems may exist but the way the browsers show it may have changed.  For example, sometimes browsers may block non-secure elements on a secure page instead of loading them and showing a warning.

The little "i" in a circle contains important information regarding why the HTTPS or site name is not green or shows no padlock.  In this case the explanation is that the connection is not secure - a suitably vague warning intended for average users, but nonetheless correct and worth trusting.  The "security" tab in the developer tools accessible by F12 key can often give more info if you are that way inclined.|

Why is it not secure even though it says it's using HTTPS?

Based on the notice it's giving, in this case the likely (but not definite; this is an educated guess) explanation is that while the page itself uses HTTPS, the page contains items on it which are fetched separately over plain HTTP.

This may sound like it's not a big security issue, but if any of the fetched items have been modified by an attacker it is possible for them to modify the page in misleading ways or even read and steal private information from the page, even though the rest of the page was initially fetched over HTTPS.  Scripts included in the page may read anything you type into forms or text fields.  CSS may modify the page to trick you into pressing something or submitting something.  Images may make the page appear to be something it isn't or try to exploit bugs.

Browsers respond to this problem in varying ways, but at minimum they indicate that the page is "not secure" in the location bar somehow.  They may display a warning and they may also block loading some elements on the page.

Why is it sometimes green but sometimes not?

This issue is usually an accident on the part of whoever built the website: they forgot to ensure some of the items on the page are using HTTPS.  Different pages can fetch different items: images, scripts, styles.  Sometimes one of the scripts fetched by a page can in turn fetch scripts of its own, and then the page is marked insecure due to a fault by a third party script that the owner of the website may not have anticipated.

What's an appropriate response?

On any page that is not marked as secure by your browser, you might choose to avoid entering personal or credit card information.  You could report the problem to whoever owns the site (as it could be losing them sales).


Security impacts of using public wifi I generally use a free college wifi and sometimes chats on telegram and also send pics can hackers access those pics and chats and can he access my gallery and see pics?
And if he hacks and install and malicious apk in it to track then can it be deleted by any way, i have reset my phone! Am i safe?

You make the assumption that by using public WiFi your phone can be hacked.
This is false.
Connecting to a public WiFi does not allow someone else to install an application on your phone. It does not allow someone else to "hack" it either. Hacking is not a magic button someone has to push and wait for the magic to happen. Real life is not a movie.
(For the cyber-nerds out there: this answer is an attempt at vulgarization. Some simplifications were voluntarily made.)


PCI DSS PenetrationTesting Requirement 11.3.4 I'm fairly new to PCI DSS and I'm confused over the requirement to perform pen-testing as per 11.3.4. as it states:-

  Are penetration-testing procedures defined to test all segmentation
  methods, to confirm they are operational and effective, and isolate
  all out-of-scope systems from systems in the CDE?

We are a small business with a single card machine that takes payment by phone.

So the CDE is essentially the entire company as the card machine connects to the internet through the broadband router. We do have a DMZ with a single machine running on it for email access, but it has no ports open between the DMZ and internal network. In addition when we perform a network scan, I include the external IP's of the machine in the DMZ in addition to the IP's of the LAN.

Do I still need to pen-test our LAN from the DMZ as it seems to me, it's all already in scope of PCI DSS?

§11.3.4 is specifically aimed at organizations that are using segmentation to limit their PCI scope.  When you say:

  So the CDE is essentially the entire company as the card machine
  connects to the internet through the broadband router.

It sounds like you're not in this category.  If the card machine is on the same flat network as all your other internal company machines, then yes, they're all in scope.  If that is the case, then §11.3.4 doesn't apply to you - here's the full text with emphasis on the parts that distinguish from what you're doing:

  11.3.4 If segmentation is used to isolate the CDE from other networks, perform penetration tests at least annually and after any changes to
  segmentation controls/methods to verify that the segmentation methods
  are operational and effective, and isolate all out-of-scope systems
  from systems in the CDE.

You're not using segmentation to isolate, so you don't need to verify you're doing so effectively.  You don't have out-of-scope systems isolated from the CDE.

So you still need to have a pen test of everything per §11.3.2 - it just doesn't need to verify your (non-existent) segmentation.


Remote Registry allows bypass of 2FA enforcement with 1FA Some organizations will configure their Windows systems to require Smart Cards for all account logins, as part of a two-factor authentication implementation. However, this can easily be bypassed without two-factor authentication under certain conditions.

The bypass requires Administrator credentials (username & password only - Smart Card & PIN not required), and either physical access to the system or access to the system's Remote Registry service.

With physical access to the system, there's much more you could do than simply disabling 2FA enforcement. So this is of fairly little concern. The Remote Registry angle, on the other hand, does seem to be a significant break in the system.

Enforcement of Smart Card login is handled by the following Registry item:

Key: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System
Value: scforceoption
Settings: 0 for disabled, 1 for enabled.

Remote Registry is commonly used in corporate environments to facilitate centralized monitoring and management services. However, access to the Remote Registry service only requires single-factor authentication with a username and password. Given:

Remote Registry is enabled on the target computer.
Nothing between the local computer and the target is blocking Remote Registry.
You're logged in locally with an account on the same domain, which has Adminsitrator rights on the target computer.

The following command will easily allow you to disable Smart Card enforcement on a remote target, without having to use a Smart Card to authenticate to it:

reg add \\[TargetHostName]\HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v scforceoption /t REG_DWORD /d 0

With some clever use of runas, you don't even have to be logged in locally with the Administrator account or use a system on the same domain. So long as you have the username and password, and can hit the Remote Registry service, a remote bypass of 2FA policy without using 2FA is possible.

While this is by far not the most critical vulnerability in the world, it does seem to be a weakness in Windows' two-factor authentication policy. Are there configuration options that can be used to compensate for this - e.g.: turn on 2FA for Remote Registry - without actually having to disable Remote Registry?

It is by Kerberos design - it verifies Smart-Card on initial logon only for interactive logons. Remote Registry - is not an interactive logon.

Yes, there are 3rd party solutions to enable strong 2FA control on a low level (DC level LSA) by using Subauthentication package LSA plugins - Authlite (hacks LSA on the fly) and Rohos Logon.


Does the destruction of sensitive information limit the choice of hard drives to non-flash based devices? Working with a non-profit organization,it's common to reuse hard drives that have previously stored highly sensitive information such as medical and financial records. This is primarily driven by cost-saving measures to reduce purchasing new hard drives.

If the destruction of sensitive information is the first requirement, does this limit the choice in selecting the type of storage medium?

For example, do non-flash based devices provide a higher level of assurance in the destruction of data using ATA Secure Erase and a single wipe in comparison to SSDs including self-encrypting drives?

Data destruction is a technique of last resort. If you are planning to use a new storage device, you should use full disk encryption. This allows you to either destroy the encrypted master key or simply forget the password, effectively rendering all data unrecoverable, despite no data actually being wiped. Encryption  is a solution for both solid state and standard hard drives. Use a strong algorithm like AES.
If you absolutely need to use a hard drive without full disk encryption, you should get one which supports SED, which is transparent hardware encryption. SED transparently encrypts all data written to the drive, but keeps the encryption key stored in a special area. When you initiate secure erasure, this key is all that is destroyed. This feature is supported on most modern SSDs and HDDs. If you do not know if a drive supports it, you can often conclude that it is supported if the estimated ATA Secure Erase time is showing as only two minutes, regardless of how large the drive itself is.
There is nothing intrinsic to the data storage methods used by solid state media that makes it hard to perform data destruction, but their firmware makes it impossible for the operating system to overwrite specific sectors due to wear leveling, a feature that spreads writes around the drive to decrease the wear and tear on individual flash cells (each of which has a finite lifespan). This does mean that you cannot overwrite data on SSDs reliably. You can still use SED if the drive implements it, and you can use ATA Secure Erase as well, but if you need to manually overwrite a range of sectors, use an HDD.
Note that, if you do use an SSD and are using full disk encryption and you have TRIM enabled, the drive will leak a limited amount of metadata, as explained in this excellent blog post. You can usually disable TRIM at a small performance penalty, but you will avoid metadata leakage. Whether or not the exact metadata leaked is problematic depends on your specific threat model.


What can my ISP see regarding my VPN tunnel? I use the free version of proton VPN because it has such a nice interface. From my understanding, when I connect to one of their VPNs located in the US, my information passes through an encrypted tunnel visible to my ISP, then to an entry node, then to a relay node, then to an exit node, then to where my internet activities are told to go.

Let's say I was a cautious internet "criminal", and my ISP believed me to be such. They've hired one of you to come out to their location and make some guesses about what i was using their service for and you are really good at your job.

What would you be able to tell my ISP?

Tough question so thanks in advance!

Your ISP would be able to see the following:

That you are using VPN
The IP address (on the ISP's network) from which you are connecting to the VPN
The IP address of the entry node of the VPN
The volume of data between any two points in time that you are sending and receiving through the VPN

Without the cooperation of the VPN provider, the ISP would not be able to see:

The web sites that you are visiting or the servers that you are connecting to

Even with the cooperation of the VPN provider, the ISP would still not be able to see the information in plaintext form that you are sending to these servers or receiving from these servers, assuming that you are using a secure protocol supported by the server, inside the VPN tunnel, such as HTTPS, SSH, SFTP, etc.

However, it should be noted that an entity that is able to surveil large swaths of the internet (such as a three-letter agency) may be able to determine the web sites that you are visiting, and the servers that you are connecting to, by using 'big data' to match up the dates and times of the chunks of packets that they see traversing your connection to your ISP, with the dates and times of the chunks of packets that they see traversing the server's connection to the server's ISP.  Even though these packets are encrypted, if they are able to match up enough of these chunks of packets over the course of time, they can determine with a high probability that it is you connecting to the server via the VPN.  Bruce Schneier writes about this in his latest book, 'Click Here to Kill Everyone'.


PBKDF2 usage will slow REST API down? When implementing password hashing using PBKDF2 for authenticating access to a REST api,when we say that PBKDF2 is slow does it mean that it's going to take a lot of time to hash the password and validate it, therefore the service not being responsive enough for the end user?
Or is it the case that is PBKDF2 slow only when the password given is not valid,not when the password is correct?

PBKDF2 and other key stretching algorithms are meant to be slow and take the same amount of time whether the input password is correct or incorrect.
To reduce computational load and latency for your user, the API should authenticate once via login credentials and issue a revokable or time-limited session token that is verified by a simple lookup.


Using AES to securely store sensitive pictures I'm not experienced with encryption at all, so please bear with me.

My use case: I'm working on a membership management web application to be used by a small organisation. When someone becomes a member, his ID gets read and the photo on this ID gets stored on our server. Only a few people with the right permissions are allowed to see the photo via the web application.

Even though it's legal to extract and store these photo's (at least in my country), it's still sensitive data, so I would like to make sure these are stored securely.

My idea is as following: when the user is registered, the image is send to the back-end (as base64 or another readable format, obviously HTTPS is used). The back-end will encrypt this image and generate a guid to be used as the file name. Both the guid and the encryption key are stored in the database as 2 fields in the users table. The encrypted file gets stored in a folder which is not accessible for the public.

When someone requests a photo, the back-end will check if the user is authorized and if he is, it will look for the file with the right guid, decrypt the photo and send it to the front-end as base64.

My first questions are: is this approach correct? Is the usage of a guid as a filename even adding extra security? My reasoning is: if someone gets access to the folder, he will not be able to see which file belongs to which member. Is storing the encryption key in the database a decent approach?

The thing I'm a bit struggling at, is the encryption itself since I do not have any experience with this. My plan is to use AES and I'm using this article as a reference:
https://www.codeproject.com/Articles/769741/Csharp-AES-bits-Encryption-Library-with-Salt

The approach looks simple enough, but I have no idea how to handle the password/key. I was thinking of generating (although I don't know how exactly) a unique password per user on which the key will be generated. Only the key will be stored in the database as that's all I need. In all approaches I've seen however, a single password is used (so the same for all users in my case) and a unique key gets generated by using salts.

I'm not sure why I would need a salt anyway. If I generate a unique password per user, which is long enough and a series of random characters, rainbow tables can't be used. But is that the right approach? And if so, what would be a secure way of generating this password? Or is my reasoning completely wrong and should I do something else?

I am not good at crypto either so edit or comment below if i get it wrong.

The first and foremost thing you need to get right is APPLICATION LOGIC.

By that i mean the logic should have effective controls such that my image should not accessible by anyone else to begin with.For example if http://example.com/imgid=(GID),Now no matter what the GID is,my image shouldn't be accessible by anyone else,at all.That is two people could have the same GID .So the back end logic should be that my SESSION is associated with the images i have uploaded and the image to my account.DO NOT USE THE SECRECY OF GID AS A LOGIC

The next part is storing images at the backend

Here you should use symmetric encryption(AES256).The encryption key should be randomly generated with sufficient entropy using a cryptographically secure random number generator.The key is generated whenever a user signs up|uploads and then gets associated with that user.Store it in a database in the user collumn its fine.Then use the encryption key associated with that user to encryt and decrypt the image.

SO TO SUMMARISE.

The user signs up.He is allotted an encryption key.
The user requests the image.
The back end logic check's if the image belongs to the user asking for it.
If it is true then decrypt it using his and only his decryption key and
send the image back.


What are good, safe, not necessarily anonymous ways to disclose vulnerabilities? Let's assume you stumble across a vulnerability in some online system, which is a commercial product by a small US company (1 to 50 employees according to Glassdoor). That online system shall be hosted for some clients and sold to others. The vulnerability shall consist in unauthorized access/privilege escalation through URL manipulation, and shall allow information to leak and to be modified, with data modification a rather theoretical threat that would easily be detected: the main issue being leaking of sensitive data. It is reasonable to assume that the company would not want this problem to become public. The vendor does not seem to have a bug bounty program.

You would not want to exploit this vulnerability. Quite the contrary, you would want to make sure this vulnerability is fixed. Specifically, you would want to make sure that clients' systems are updated, and clients are informed about the potential of past leaks. (The latter is hard to detect without public disclosure.)

Ideally, you would also welcome some recognition (not necessarily money - maybe something to put onto your CV is all goes well); ideally, you would like to be thanked publicly for finding and reporting the vulnerability, alongside with a public disclosure. Obviously, you would not make monetary payments a condition for disclosure---compare Is demanding a "donation" before disclosing vulnerabilities black hat behavior?

I understand that contacting the clients would not be ideal, to say the least---compare Contacting customers of vulnerable software, is it wrong?

I also understand that in the US (assume you are not US-based, but might want to travel there), even modifying a URL can be considered illegal---compare At what point does "hacking" become illegal? (US). Therefore, one may not want to want to contact the company with a real name, at least to begin with.

So, what are good and safe ways? The following alternative solutions came to my mind (these are four individual ideas---not four steps of one idea):

Write an anonymous email (through Tor etc.).
Convince the company that a bug bounty program was in their best interest. Wait for it to begin, then disclose through the bug bounty program. This would have the benefit of at least some legal protection for the disclosing party, as I understand it.
Disclose through openbugbounty.org. Publicly disclose after 90 days.
Reserve a CVE to later prove that one is the discloser.

Some questions related to the above ideas (I may break them up into individual questions if people think this makes sense):

I came across this comment, which sounds wrong to me:

  In extortion the payment is mostly for not publicly disclosing the vulnerability, not so much for its private disclosure. If you would just ask money for private disclosure without threatening exploiting it or public disclosure, I would not think of it as extortion.

Is this an accepted opinion?

How would one do that without appearing extortionary? Can one publicly disclose if the bug bounty program does not imply public disclosure by the company?
Is that available to use for any website, or just participating websites?
Then what?

I would say that if you are withholding this information to receive recognition you are in this for the wrong reasons

Contact your local CERT and have them help you would through the disclosure process. This way you should be shielded from the company and the CERT should have a process for handling responsible disclosure between the two parties.

If you want recognition you will need to talk to the company directly or check if they have a security.txt located on their site with relevant information.

You will not get a CVE issued for a single website I'm afraid.


How do I get the "n" (modulus) field in the jwk response We have a web-service that follows RFC 7515 / JWT: it supplies public keys on a /jwt endpoint and encodes data transferred on its main endpoints into JOSE+JSON. Using several standard JAVA libraries to achieve this process everything is now up and running.

I want to manually create the output for the /jwt endpoint that provides the public key in my keypair to supply it as a plaintext mock, however, I am not sure how to generate the "n" field of the jwt. The specs say this:

  6.3.1.1.  "n" (Modulus) Parameter

  The "n" (modulus) parameter contains the modulus value for the RSA
  public key.  It is represented as a Base64urlUInt-encoded value.

How do I properly get to the modulus value as Base64urlUInt?

Example

I have created a simple RSA key pair in Keystore Explorer for this question, of which the public key is the following:

-----BEGIN PUBLIC KEY-----
MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA9KGWjySg0x9yJ5uOi8yF
JUS6jB9OC/DvOoTlZibihRZNo5Z54lyfE1tC5a5Cn0rpYlvo4xFoCFEqwSUOapmk
/n30rCTixBibhee/J7r9kRmavPijn6V54kaOuJ2fI0UY6JziS52tz/XXmbbtMyBR
KCeVSN9PmNyRMJ5WUsnnk4j/U853opPVhsPpSgN2kSOHVX8ZlsJL/HFTx8mfY8DS
5f/ayLwsuNmM7h/DIktvhfbtfYQ7pssuAafJ2NCykBh6ZgnL9huKkmlTz54/2Lcv
o78UJVHWWYQq10Mm1HJ0ivH+j7hZEMJqUNmbkya1PVRMhAMu0o+20vubr9X2Rifv
awIDAQAB
-----END PUBLIC KEY-----

And in the Keytool Explorer UI I can naviate to fields of the public key, for which the modulus value is this:

0xF4A1968F24A0D31F72279B8E8BCC852544BA8C1F4E0BF0EF3A84E56626E285164DA39679E25C9F135B42E5AE429F4AE9625BE8E3116808512AC1250E6A99A4FE7DF4AC24E2C4189B85E7BF27BAFD91199ABCF8A39FA579E2468EB89D9F234518E89CE24B9DADCFF5D799B6ED33205128279548DF4F98DC91309E5652C9E79388FF53CE77A293D586C3E94A0376912387557F1996C24BFC7153C7C99F63C0D2E5FFDAC8BC2CB8D98CEE1FC3224B6F85F6ED7D843BA6CB2E01A7C9D8D0B290187A6609CBF61B8A926953CF9E3FD8B72FA3BF142551D659842AD74326D472748AF1FE8FB85910C26A50D99B9326B53D544C84032ED28FB6D2FB9BAFD5F64627EF6B

As far as I can tell, Base64URLEncoded this becomes:

  MHhGNEExOTY4RjI0QTBEMzFGNzIyNzlCOEU4QkNDODUKMjU0NEJBOEMxRjRFMEJGMEVGM0E4NEU1NjYyNkUyODUKMTY0REEzOTY3OUUyNUM5RjEzNUI0MkU1QUU0MjlGNEEKRTk2MjVCRThFMzExNjgwODUxMkFDMTI1MEU2QTk5QTQKRkU3REY0QUMyNEUyQzQxODlCODVFN0JGMjdCQUZEOTEKMTk5QUJDRjhBMzlGQTU3OUUyNDY4RUI4OUQ5RjIzNDUKMThFODlDRTI0QjlEQURDRkY1RDc5OUI2RUQzMzIwNTEKMjgyNzk1NDhERjRGOThEQzkxMzA5RTU2NTJDOUU3OTMKODhGRjUzQ0U3N0EyOTNENTg2QzNFOTRBMDM3NjkxMjMKODc1NTdGMTk5NkMyNEJGQzcxNTNDN0M5OUY2M0MwRDIKRTVGRkRBQzhCQzJDQjhEOThDRUUxRkMzMjI0QjZGODUKRjZFRDdEODQzQkE2Q0IyRTAxQTdDOUQ4RDBCMjkwMTgKN0E2NjA5Q0JGNjFCOEE5MjY5NTNDRjlFM0ZEOEI3MkYKQTNCRjE0MjU1MUQ2NTk4NDJBRDc0MzI2RDQ3Mjc0OEEKRjFGRThGQjg1OTEwQzI2QTUwRDk5QjkzMjZCNTNENTQKNEM4NDAzMkVEMjhGQjZEMkZCOUJBRkQ1RjY0NjI3RUYKNkI=

However, that value doesn't work in my program. Also, using publicly available PEM->JWT converters (e.g. JWK to PEM Convertor online) I get different results for the modulus "n", see:

{"kty":"RSA","e":"AQAB","kid":"351556fe-fc69-4cf7-bce6-47a8806445a0","n":"9KGWjySg0x9yJ5uOi8yFJUS6jB9OC_DvOoTlZibihRZNo5Z54lyfE1tC5a5Cn0rpYlvo4xFoCFEqwSUOapmk_n30rCTixBibhee_J7r9kRmavPijn6V54kaOuJ2fI0UY6JziS52tz_XXmbbtMyBRKCeVSN9PmNyRMJ5WUsnnk4j_U853opPVhsPpSgN2kSOHVX8ZlsJL_HFTx8mfY8DS5f_ayLwsuNmM7h_DIktvhfbtfYQ7pssuAafJ2NCykBh6ZgnL9huKkmlTz54_2Lcvo78UJVHWWYQq10Mm1HJ0ivH-j7hZEMJqUNmbkya1PVRMhAMu0o-20vubr9X2Rifvaw"}

How do I calculate this "n" myself properly? I have tried removing the 0x prefix from the modulus, and the base10 value of the modulus to no avail. It would be extra handy if you could help me finding the right parts directly in Keystore Explorer.

You base64url-encoded the characters 0, x, F, 4, A, 1, etc., plus CRLF pairs every 32 characters. The display 0xF4A1... is a C/python-style hex representation of what is actually a binary value; you need to encode that value, consisting of bytes whose values in hex are 0xF4, 0xA1, etc. How you create such a value depends on the programming language(s) or tool(s) you are using which you didn't specify, and anyway this is not about information security but basic programming.

Although as an awful hack which may be acceptable for testing only, which depends on the ASN.1 DER encoding making it marginally on-topic IMBO, because DER of X.509 SubjectPublicKeyInfo for 2048-bit RSA key has the modulus magnitude at a multiple of 3, you can textually manipulate the PEM format by:

remove the BEGIN and END lines and join the rest to a single line/string
delete the first 44 and last 6 characters (encoding the first 33 and last 4.5 bytes)
change any + and / characters to - and _ respectively

-----BEGIN PUBLIC KEY-----
MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA9KGWjySg0x9yJ5uOi8yF
JUS6jB9OC/DvOoTlZibihRZNo5Z54lyfE1tC5a5Cn0rpYlvo4xFoCFEqwSUOapmk
/n30rCTixBibhee/J7r9kRmavPijn6V54kaOuJ2fI0UY6JziS52tz/XXmbbtMyBR
KCeVSN9PmNyRMJ5WUsnnk4j/U853opPVhsPpSgN2kSOHVX8ZlsJL/HFTx8mfY8DS
5f/ayLwsuNmM7h/DIktvhfbtfYQ7pssuAafJ2NCykBh6ZgnL9huKkmlTz54/2Lcv
o78UJVHWWYQq10Mm1HJ0ivH+j7hZEMJqUNmbkya1PVRMhAMu0o+20vubr9X2Rifv
awIDAQAB
-----END PUBLIC KEY-----

->

9KGWjySg0x9yJ5uOi8yFJUS6jB9OC_DvOoTlZibihRZNo5Z54lyfE1tC5a5Cn0rpYlvo4xFoCFEqwSUOapmk_n30rCTixBibhee_J7r9kRmavPijn6V54kaOuJ2fI0UY6JziS52tz_XXmbbtMyBRKCeVSN9PmNyRMJ5WUsnnk4j_U853opPVhsPpSgN2kSOHVX8ZlsJL_HFTx8mfY8DS5f_ayLwsuNmM7h_DIktvhfbtfYQ7pssuAafJ2NCykBh6ZgnL9huKkmlTz54_2Lcvo78UJVHWWYQq10Mm1HJ0ivH-j7hZEMJqUNmbkya1PVRMhAMu0o-20vubr9X2RifvawID

Presto!


security clearance for programmers I am programmer by day and night, I work within security at the moment working on some security products. I have noticed a few non software engineering based roles which require security clearance. I was wondering is there any cases within software engineering / programming that developers require security clearance ?

If the answer is yes where would one get this type of accreditation ? and what are some useful resources on this subject ?

Yes, there certainly are circumstances that require programmers to hold security clearances.   The most common is when working for directly for the federal government at any of a number of agencies including the Department of Defense, Department of State, FBI, NSA, and a number of others.   In the private sector, you'll most commonly see clearance requirements for jobs working with defense contractors, though it could feasibly be a component of a job for any government contractor.

In order to obtain a security clearance, there must be a necessity.  It's not like a certification that you can get just to make yourself more employable...It must be obtained in concert with a project or position that requires you to be handle classified information.   Classified information could mean anything from the contents of sensitive communications, to plans, to specifications of weapon systems, even down to the implementation details of software that serves a sensitive purpose.  Clearances also don't last forever.  Not only is periodic re-certification required, but if you leave the position that requires you to hold a clearance, it will eventually expire, assuming you don't take another position that also requires clearance, of course.

Clearance is not something you can pursue as an individual.  It must be justified by the agency or company that you work for, based on the fact that they already have programs or contracts in place that require them (and therefore you) to deal with classified information as I described above.

For additional information on security clearances in the U.S. (the country for which this answer applies) the State Department website has details.


Generating a DER-encoded DSA public key of a particular file size I am reverse engineering a binary that contains a raw, DER-encoded X.509 certificate containing a DSA public key. I want to replace this certificate with one that I have generated so that I have access to the private key.
Due to this certificate being inside the binary, I need to replace it with a certificate of the same size in bytes, so that offsets of other data within the file are unharmed.
When I generate my own key-pair using OpenSSL, or Python, or any other method, and I export it, it is close to the file size I need, but not quite. This is just due to the random nature of generating a DSA key.
Is there an easy way to do this, besides picking my own numbers and manually performing the math necessary to generate the DSA keys? It doesn't need to be secure, this is just a fun little experiment.

There are lots of things in an X.509 certificate other than the publickey whose sizes can be varied to pretty much anything you want, especially if you don't care about security: all the name fields, CRLDP, AIA, Policy, maybe more.

For the DSA publickey in the cert (assuming 'normal' format not implicitlyCA which practically no one used) P and Q will always be the same sizes, each with one 'extra' octet in DER over the nominal sizes because the nominal sizes are multiples of 8; G and Y (each) will less than half the time have an 'extra' octet or very rarely be less than nominal size, and are chosen effectively at random independently so it should take only one or two tries (e.g. openssl commandline dsaparam then gendsa) to get each 'right'.

If you self-sign, which is usually what the easiest to use tools do, both R and S in the signature have the same properties as G and Y in the key, so depending which case you want it will often take 2 or 4 tries, and possibly a few more, to get what you want. You could instead sign with an RSA CA (also fake, of course) in which case the signature is always exactly the size of the modulus and that can be chosen any size up to 16ki bits (2ki octets) although over 4ki bits it will probably get slower.

Since you give no details about what you are actually doing or getting, I can't be more specific.


Chrome allow insecure localhost I have just stumbled upon what is a very helpful flag in chrome (for developers):
chrome://flags/#allow-insecure-localhost

The flag is described as:
Allow invalid certificates for resources loaded from localhost.
Allows requests to localhost over HTTPS even when an invalid certificate is presented. – Mac, Windows, Linux, Chrome OS, Android

Having always had to generate self signed certs for multiple services this is great, but it begs the questions - is this secure? Is this secure to leave on all the time?
If this is not secure what are the attacks possible?

It's most likely fine.
There are a few situations in which you want to communicate with localhost using HTTPS - such as running a local webserver for web development purposes or some other service that offers a web interface.
The way to do it "properly" is to generate a self-signed certificate, set up your web server to use that certificate, and then manually import that certificate as a trusted certificate. This is a tedious process, and in order to remove this friction, browsers give you the option of pretending like https://localhost is sending some trusted certificate, even though it's not.
So is this secure? That depends on your threat model. For day-to-day browsing activities, you'll likely be fine. It's difficult for an attacker even in your local network to impersonate localhost, since it's written directly in your hosts file, which on most setups has higher priority than DNS - which means even with a compromised DNS server, connections to localhost still would not be redirected to the attacker.
So why is this not the default if it's most likely secure? Because it's not the "expected" behavior of a browser. The expected behavior is that upon connecting to a host using HTTPS, the certificate is validated and the connection is refused if the certificate is invalid. You as end-user have to make a conscious decision to change this behavior and allow this exception.
So when would this be insecure? When would it actually pose a threat? To be honest, I struggle to think of an example that isn't completely contrived. Strange hostname resolution configurations in which localhost would be resolved via DNS and spoofed to be some host other than 127.0.0.1 would come to mind, but that is a very unlikely scenario, and one in which the user has to go out of their way to configure their system to be vulnerable. However, I don't want to say "it is perfectly fine in every possible setup", since there is always a chance I am missing something.


Is it dangerous to allow user to view a file directory via web browser? I have a URL which displays all of the pdf files at a given dir by visiting the following site location :

http://www.mysite.com/allpdffiles/

Does this present any security vulnerabilities?

It depends on what's in there.

Originally the idea behind the web was to provide a catalog of useful information; each file in a public directory contains some piece of information, and an index is automatically generated to make that information accessible. The whole reason why your default file is traditionally called index.html is because that file theoretically is supposed to be an index, just like the auto-generated one, but perhaps formatted differently.

If the directory contains nothing but publicly-accessible files (such as pictures, PDFs, HTML files, or what-have-you), then the auto-generated index is no less secure than an equivalent manually-generated index.

But if instead you have some sort of web app -- and particularly one written in PHP or ASP or ASP.NET or a similar language where the application files are stored inside  the document root mixed in with the media -- then the auto-generated index may provide links to files that you didn't intend to make public. This is even more true if you have "include" files in there as well. And in that case, this automatic index could make it easier to find files that could lead to a vulnerability.

Note that the index itself is not a vulnerability and is not a security risk in itself. Instead, it could assist in locating and exploiting some other security vulnerability on the site. If you have no such vulnerabilities, then the index does not add any risk on its own.

Furthermore, all of the practices that could make a directory index dangerous are, themselves, categorically bad practices, and are not made safe simply by removing the  index directive.

This specifically includes placing server-side code files in your document root. To be safe, you should have ONE file (index.php) inside your document root, and ALL the other files outside. Your index.php file should contain nothing but bootstrap code that loads and executes your webapp, while the webapp handles all URL routing independent of your filesystem structure. Aside from that, your document root should only contain static files that are safe for anyone to view.


Does it increase security to hash a SHA1 hash with a common salt with SHA256 with individual salt I tried to find a similar question but I did not find a question describing my exact scenario and I am still puzzled if the following actually makes an application more secure.

I have legacy passwords stored with SHA1 and a common salt imported to my system. If the user logs in, I am able to rehash the password itself with a stronger algorithm - that's fine. But for the import I want to hash the SHA1-hash again with SHA256 (or better bcrypt) and an individual salt and afterwards remove the SHA1-hash - in my understanding this should increase the security as I increase entropy by adding an individual salt and using a stronger hashing algorithm. Is this correct or does the decreased entropy from SHA1 remain when doing this?

As far as I can tell, there should not be any reduction in security to what you're doing as long as this are only applied to the legacy passwords. New passwords and users that have logged in should just use the new hashing system without going through SHA-1 first.

Passwords migrated from the legacy system in such a way will be at least as good as the old system. The use of SHA-1 means that for users with really long, high entropy passwords, theoretically the migrated password isn't stored as securely as the same password stored only through the new system; however if the user has a really long, high entropy password, then their passwords don't need to be salted to begin with to be secure. Practically, this should be of little concern.


Securing a website for my school project I have been given a task to secure a website which will be done by my group mates, but I have no clue. Could someone give my ideas? and how I am going to protect? what code can I use to secure login page?

It definitely sounds like you could get clarity on a the task.

But if that's all you have, I would start here: https://www.owasp.org/index.php/OWASP_Top_Ten_Cheat_Sheet

These are the 10 most common vulnerabilities for web applications. I would suggest going through each one following the instructions for checking whether they exist and steps to remediate them.


Would it be possible to store Kerberos tickets on a YubiKey? Kerberos supports different ways (ccache types) of storing tickets, such as:

FILE
MEMORY
KEYRING

I was wondering whether it would technically be possible to also store the Ticket-granting-ticket and service ticket in a YubiKey. These tickets could then be read from the key when they are needed and directly be erased from memory after being sent.

I know that the whole point of storing a private PGP key in a YubiKey is the fact that it can only be written and never be read again. All necessary operations are executed inside the YubiKey.

Kerberos tickets would have to be readable so they can be sent to the Key-distribution-center or web service.

So, would it be possible to use a YubiKey as another ccache type for Kerberos?

This is a weird/bad idea.

You'd likely better off somehow integrating the YubiKey with RFC4556 aka pkinit.

  Abstract
    This document describes protocol extensions (hereafter called PKINIT) to the Kerberos protocol specification.  These extensions provide a method for integrating public key cryptography into the initial authentication exchange, by using asymmetric-key signature and/or encryption algorithms in pre-authentication data fields.


Can users read client SSL certificates from a react native mobile apps APK? I want to secure an API used by a react native app. If an authorisation header is sent, the user can read the request and access data. To avoid this I want to use  SSL client certificates.

Now if I place the certificate in the assets folder, will it be possible for the user to get it from the APK? If yes, how can it be avoided?

Is there any other way to secure the request?

You cannot realistically hide the data stored on the device from the device owner. Both jailbreaking and offline analysis of a device can reveal it, as well as simple glitches in your app.

So you are better off using an established security protocol, like oauth2.  Together with a principle of only downloading or storing data the user owns, and accepting that they manipulate it, you have reasonable security.  If data must be kept secret from the user, it must be stored on the server.

Mutual TLS with the app's private key generated during installation, can also give you a reasonable expectation that the device connecting to your server is always the same. In practice, a strong device linking.  No other apps will be able to present the same device certificate.  But expect the owner to be able to read its private key.


Brute force algorithm to break symmetric key. How to find the program when current key is the correct one? In a brute force program, sequential keys are tested against the public key in order to find the correspondent private key.

My question is, how is the test done with each key that let you conclude you have found the correct key to break into the encrypted text?

I suppose  the text is read after each test and if some keywords are found you know this is the correct key, but if this is the way, is easy to counteract this technique scrambling the text with a traditional encryption algorithm and then with the symmetric key.

Ideally you need to have some idea of what you are looking for, but in most situations your plaintext should be relatively easy to distinguish. You might be able to identify it because it contains English-language words/grammar, or fits a known file format, for example.
Unicity Distance
If the ciphertext is short enough, the problem might be that there is more than one valid plaintext for a single ciphertext, although only one of these is the intended message. The additional valid keys are spurious. This is the concept of 'unicity distance': the length of a ciphertext needed such that there are no spurious keys.

Consider an attack on the ciphertext string "WNAIW" encrypted using a Vigenère cipher with a five letter key. Conceivably, this string could be deciphered into any other string — RIVER and WATER are both possibilities for certain keys. This is a general rule of cryptanalysis: with no additional information it is impossible to decode this message.

https://en.wikipedia.org/wiki/Unicity_distance
In the event that there are spurious keys, you need an even more specific idea of what you are looking for (e.g. keywords like you suggested).
Otherwise, as an attacker, you need enough ciphertext to meet the unicity distance in order to be sure.

For DES, the unicity distance is 8.2 bytes. For 128-bit ciphers, it is about 19 bytes.
This means that if you are trying to brute-force DES you need two ciphertext blocks. (DES's block length is 8 bytes.) Decrypt the first ciphertext block with one key after another. If the resulting plaintext looks like English, then decrypt the second block with the same key. If the second plaintext block also looks like English, you've found the correct key.

https://www.schneier.com/crypto-gram/archives/1998/1215.html#plaintext
Obscuring The Plaintext
Further obfuscating the plaintext, like you suggested, could therefore be effective in theory as long as the attacker did not have the requisite insider knowledge, and they were not checking for the obfuscation. This has to be carefully considered, because the attacker may have successfully found the correct key, and it's just a question of identifying that they have done so.
Also, we need to consider that certain (or many) methods of obscurity could be identifiable. Something trivial like Base64 encoding would be trivial to identify, and easily programmable as a check. Even if the plaintext was actually another ciphertext, there are potentially techniques for identifying these too (although they are not trivial) (e.g. http://practicalcryptography.com/cryptanalysis/text-characterisation/identifying-unknown-ciphers/).
As a result, although this has the potential to make an attacker's life more difficult, it is obscurity rather than security, and I would still ensure the level of encryption was suitable for purpose even if the plaintext was not obscured - i.e. I don't think it should be relied upon as part of the security mechanism.


Is it safe to use the SHA1 checksum of a password as a key for SHA-1? I have an authentication system, where the passwords are stored with bcrypt hash (node passport module).

My server generates a random key (128bytes) at startup.

Whenever a user logs in, the server calculates the SHA-1 of his password (right after a successful authentication), encrypts it using AES with the randomly generated key, and temporarely stores it in a database, along with the other hash.

This SHA-1 sum will be used as an AES key to encrypt/decrypt user information that will be stored in the same database.

Is this method safe?

The general response to this is correct - if your server is storing a copy of a key that's used to encrypt something in memory, there is a chance that an exploit will allow it to be stolen. (See: heartbleed)

I think it's definitely worth asking in this case why you need to store a hash and an encrypted version of the password. I can see a system in which you're logging into another service on a user's behalf and need their password, but since you mention:

  and temporarely stores it in a database, along with the other hash

I suspect this is not the case. There are very strong arguments for not using a reversible algorithm to store passwords in a web database, and I would like to understand your reasoning for wanting to do so.


Protecting SSH service with many inexperienced users One of the universities I know has a rather unique password policy. They issue shell accounts to all computing students with strong passwords that are unchangeable. It is done via the passwd -n flag which sets the minimum number of days between password changes. A high enough number essentially means that the user will never be able to change his/her password.

The passwords are then sealed in an envelope which can be opened only by the student. Students are reminded to request a new password if the envelope's seal is broken.

When prompted on this unique practice, the university mentioned that many students in the past used a weak password and a number of accounts were compromised through brute force attacks.

Another university in a very small country simply uses a GeoIP filter to block out all brute force attempts.

Does anyone know of any other practice which can be used to protect a SSH service which is used by many inexperienced users?

I suggest Fail2ban on all SSH servers, especially with inexperienced users.  This lets you block any IP that fails to log in too often (iirc, the default is 10 tries in 10 minutes gets an IP blocked for 10 minutes). This may now be possible with just OpenSSH via MaxAuthTries, MaxSessions, and MaxStartups.

In addition to that, I'd suggest regularly running John the Ripper on each user's password hash. If it finds the user's password, have it email the user a guide to better passwords and require the user to change the password. (Be sure to make that email easily verifiable; the last thing you want is for the user to discard it as a phishing attack!)

Passwords that cannot be changed are dangerous.  The password is likely hard to remember, so the user will probably write it down, and somebody else could find that note.


What are the pros and cons of using yubikey with ssd hardware encryption? I'm considering trying out yubikey and I've recently discovered that the (crucial m500) SSD I recently bought supports hardware encryption.

I think it should be possible to use a yubikey to provide the password for HDD encryption as it appears as a usb keyboard as far as I know.

I've never used hard drive encryption before, and it seems like a hardware based solution makes it a lot more convenient and high performing than a software based approach.

What are the pros and cons of this an approach?

I would want to dual boot windows and linux. Is hardware encryption external to the OS and therefore have no requirement for any special configuration?

I recently had to make the choice between using hardware versus software encryption for my hard drive. In the end I decided to use software based encryption for the simple matter that the software used has been vetted, tested and is generally considered secure.

My biggest problem with hardware encryption is that often there is no disclosure of how the encryption happens, how the keys are stored and which algorithms are used. My biggest worries were:

random number generation
key generation
backdoors (master keys for "vendor recovery")

For me personally this was too black box to be secure and hence I opted for software encryption. In the case of 7200 RPM and especially Soild State Drives the performance impact is not noticeable generally. In case you are using heavy write applications, you will notice a difference in speed degradation but even then it's still the difference between super fast and ultra fast.


ssh-keygen: sshd host key setup When setting up an sshd daemon and generating a host key with ssh-keygen -A what options are best practice to add?

How do I remove keys which may have already been auto-generated with sub-optimal options?

You can safely remove the keys stored in /etc/ssh, generate new keys and restart sshd. There is nothing more to it than that.

But please note that every client that have the old key stored in their known_hosts file will complain. You will need to remove that record from your clients. This can be done using ssh-keygen -R <hostname>


Any way to bypass this xss filter? I'm wondering if there is a way to bypass this xss filter

XSS Context: In a script tag

What the filter does:

lowercases the user input
doesn't encode < > UNLESS </script is present (it doesn't encode >),
if it is it'll encode the first closing angle bracket so a payload would look like this: &lt;/script>

I'm  not that experienced in XSS so I don't know if there is a way to bypass it. My thought right now is if there isn't I'm going to hopefully try to find something that is being stripped from the user input and hope the stripping is done after the encoding of </script (since nothing about </sccript>, ect, gets encoded)

Edit:

an example:

<script>
var user_input = ''
</script>

the only way I know how to break out of this is either to use ' (which I can't because it's escaped), or use </script> to close the script tag (https://jsfiddle.net/1uch6nv2/)

Edit2: I made a quick example of the filter being used, so maybe you can get a better idea, the escaping of ' and \ may not be full proof my in my script, but it is in the website I'm looking at.

It's in python so it's a little either to understand

user_input = ""

while True:
    user_input = input("User Input: ")
    user_input = user_input.lower()
    user_input = user_input.replace("'", "\\'")
    user_input = user_input.replace("\\", "\\")
    print("<script>\n\t var user_input = '" + user_input.replace("</script", "&lt;/script") + "'\n</script>")

Example output:

User Input: </script>
<script>
     var user_input = '&lt;/script>'
</script>

An excellent resource for bypassing these kinds of rudimentary filters can be found on OWASP's Filter Evasion Cheat Sheet.

This is a pretty terrible filter. Whilst I have no direct access to what you're looking at, if it is as described then there should be no difficulty in bypassing it at all. Assuming this is your website or one you're providing feedback on, you should always use an industry standard and well tested XSS sanitizer, kept frequently up to date.

Examples (not endorsements!) of ones you might want to look at:

XSS.js - Node.js HTML santitizer
HTML Purifier - PHP HTML sanitizer
Sanitize - Ruby HTML sanitizer

If you don't want to use a library (not recommended!), you might try aggressively escaping or removing special characters. This is bad for user experience, though.


What is a threat model, and how do I make one? I asked a question on what I need to do to make my application secure, when somebody told me:

  That depends on your threat model.

What is a threat model? How do I make a threat model for my application?

FilipedosSantos' answer does a great job of explaining a formal threat modelling exercise under, for example, the Microsoft STRIDE methodology.

Another great resource is the threat modeling course outline on executionByFork's github.

When I use the term "threat model" on this site, I usually mean something less formal. I generally use it as a response to new users asking "Is this secure?" as if "secure" is a yes/no property. It's usually part of a paragraph like this:

  That depends on your threat model. "Secure" isn't a thing; secure against what? Your kid sister snooping on your iPhone? A foreign government soldering chips onto your datacentre equipment? Or something in between?

I really like the Electronic Frontier Foundation's threat modelling framework, which focuses on asking these three questions:

  What are you protecting?
  Who are you protecting it from?
  How many resources can you invest in protecting it?

I really like the way the EFF has written this because these simple and easy to answer questions can guide someone with zero background in security into figuring out "the right amount of security" for them.


Can Javascript engines that run on the JVM be used to implement the Spectre exploit? I see that Chrome and Mozilla have added mitigations into their javascript engines for the Spectre vulnerabilities (CVE-2017-5753 & CVE-2017-5715). However I cant find anything regarding javascript engines that run on the JVM for example Rhino and Nashorn.

Is there any reason to think that these javascript engines are not capable of executing code that exploits the vulnerability?

Thanks

Exploiting Spectre (and Meltdown) requires the ability to time things with reasonably high precision (on a modern CPU, in the tens of nanoseconds range).  Javascript engines that don't do JIT compiling don't provide the precision needed to do this.


Generate DB Password from license key - a good idea? There's this web app which has a SQLServer database, and the connection string it uses to access the database is not stored in any configuration file. Rather, the designers decided it would be a good idea, to write an algorithm to generate the password from the customer's license key.

Is this a common technique? Is it secure?

The inability to change the key is the primary problem here.  If it were ever to get compromised, it would be impossible for the customer to change the admin password of the database.  I'd say that is a pretty big negative security implication.


Postgres protection from SQL Injection Postgres allows dynamic code execution, which might leave it vulnerable to SQL injection.

What protective measures does it have against this?

The same as any other database using SQL, use the following (taken from the OWASP cheat sheet)

Option #1: Use of Prepared Statements (Parameterized Queries)
Option #2: Use of Stored Procedures
Option #3: Escaping all User Supplied Input
Also Enforce: Least Privilege
Also Perform: White List Input Validation


Sample vulnerable web apps to test Pentesting platforms I am looking into a web application vulnerability scanner for my organization.  I would like a sample web application that is loaded with vulnerabilities (similar to metasploitable on the application side) to test various solutions on.  Does anyone know of any?

I would like to compare the thoroughness of commercial solutions such as Accunetix with some of the free scanners such as darkmysqli, wapiti, w3af and the others that come with backtrack as well as my own manual testing in order to come up with hard numbers as well as get a feel for the tools.

EDIT:
Yes I know I can install Wordpress 1.x, osCommerce (lol), or an old version of Joomla


a single ip adress host multiple domain at the same time, how do i scan it using nmap or other tools? lets say an ip adress 111.111.111.111 host multiple domain, (example.com , exampleid.com , admin.example.com, etc.) and i wanted to scan it port, how do i scan a spesific domain (headers key: Host value : example.com)?

...  i wanted to scan it port

Port scanning essentially checks if a port is open on a specific IP address or not. For this port scanning it does not matter if there are multiple hostnames for the same IP address: the scan result will not change since the hostname is not relevant for the scanning in the first place but only the IP address.
The situation is different if one wants to get application level information though, like the contents of a website on a specific domain, the certificate returned etc. Here the hostname can make a difference, depending on the protocol. Notably for HTTP the hostname is given in the HTTP Host header, for TLS it can be given as SNI in the TLS handshake and for HTTPS both TLS and HTTP information are relevant.
For scanning at this level one first needs to know the relevant hostnames for this domain, i.e. there is no automatic mapping from IP address to all available hostnames. And the choice of tool then depends on what one want to extract as information - there is no generic tool to extract everything. A simple wget or curl is sufficient to get the contents of a website and openssl s_client can be used to get the certificate for example.
But again, all of this is not about port scanning anymore since if a port is open or closed does not depend on the actual hostname, only on the IP address and port.


Is it possible to un-spoof a spoofed caller ID? I know that Trapcall allows mobile telephone users to forward their calls to a toll free number, which then forwards them back to the user's telephone, allowing them to see the caller ID. However, this A) is only available thru Trapcall for mobile phones and B) according to this question, it doesn't always work for VOIP callers.

I have been repeatedly harassed by a scammer calling my land-line (15+ calls per day). Each call is placed thru a new spoofed phone number. Because I run a home business, I need to be able to answer calls from numbers that I don't know, and thus I cannot ignore calls from numbers that aren't in my contacts. Additionally, since a new number is used each time, blocking the numbers that the scammer calls me from is ineffective.

Is there any way to get the true caller's phone number? If I were to file a John Doe lawsuit against him, would there be a way to get his phone number from subpoenaed calling records? Or are spoofing services sophisticated enough that all of the records would only show me being called from the spoofed numbers?

When a call is placed into the PSTN, three different numbers are associated with it.

The standard caller ID: this is analogous to reply-to: in an email. This can be anything the user desires, and the name is matched from an external database.
Calling ANI: This is the phone originating the call, it typically has to be a number on the caller's account.
Charge ANI: This is the number that will be charged for the call, or whose carrier will be reimbursed for a toll-free call. This number is always a number on the caller's account. (except in cases where it is empty, like skype free calls in the past)

Consider the case of an executive making a call without assistance.
Caller ID: +1 (123) 555-0102 - Secretary's number, who should handle return calls.
Calling ANI: +1 (123) 555-0112 - Executive's direct number, the number making the call.
Charge ANI: +1 (123) 555-0130 - Company's main call in number, the account that will be charged for the call.
However, only the Caller ID is sent to the end user, unless the call is toll-free, or the callee subscribes to ANI from their provider.
It is also worth noting that a user can dial a feature code to have the call
'traced', and diagnostic information retained, but a court order is required to access this information (and possibly ditermine the true source.) However the customer is charged for the trace even if no investigation is made by the authorities.


Can a faked iPhone SMS log be detected SMS messages received by an iPhone is stored unencrypted in an SQLite database, which may be extracted by backing up the phone.

You can manipulate (tamper with, e.g: replace the text of a message with a different text) the contents of this database with a number of tools and then restore it to a different iPhone.

Is it possible to prevent or detect this type of tampering when one only have access to the phone where the messages have been "restored"?

For instance: Are there any built-in integrity checks (hashes, checksums, etc.) to protect the integrity of the iPhone SQLite database?

There is no way of protecting that in particular.

What I mean is that there is no way of demonstrating that the database was not manipulated itself, BUT, the point is that to be able to manipulate that database in modern versions of iOS (in older versions, the backup could be manipulated and dumped back to the device) you should jailbreak your iOS device, and that really leaves tracks of manipulation on the phone.

As far as I know.

Source: Asking around.


What steps do you take to keep both your computer and internet browsing secure? I am thinking about your browser setup, antivirus protection, vpn, browsing best-practices and so on.

I suggest running Win7 inside Win7 using VirtualPC and revert to an original snapshot before and after browsing. I use EMET to lock down Win7 further, and the CIS benchmarks are also worth investigating. Using BitLocker with a TPM chipset board is good not only for confidentiality (using full-disk encryption) but also for file integrity.

Firefox without Flash, Silverlight, or Java installed and running NoScript (but tuned) works nicely for the time period that you will be browsing. If you're going to run Flash (e.g. YouTube or Flash movie) or a Java applet, open Chrome, watch it, and then close out all instances. You should probably use file integrity monitoring on browsers, browser plugins, and common system managed-code VMs such as your JVM, Flash engine, and .NET CLR.

If you have a work connection, avoid VPN and instead use SSL-only Outlook Anywhere (not OWA), use S/MIME encryption at the message level, and additionally store OST's on a BitLocker, Truecrypt, or similar volume. Unless you're a sysadmin and are constantly performing tasks that require a VPN -- don't log into it. It's safer for you and everyone if you just never use the VPN. I might suggest creating a special VM-guest or have a special laptop just for VPN if you do require it. OpenVPN with client-side certs is probably a fairly good VPN solution compared to the commercial offerings, which are all equally bad and promote security theater.

Anti-Virus agents are a waste of time/resources (and probably make you less secure), but it might be a good idea to occasionally scan VM-guests or Host OSes using an outside scanner, and the Symantec one isn't awful for this purpose, although some information I've seen leads me to believe that Kaspersky, Avira, NOD32, Gdata, and Sophos are sometimes superior (see http://av-comparatives.org). There's a lot of security theater here, too.

This is going to sound really crazy for mobile security, but I guess that I suggest getting a (non-GSM, non-iDEN) BlackBerry but setting up your own Windows SBS machine with BES Express (all with CIS-benchmark/etc hardening guidelines to remove things like BlackBerry off-line backup, etc). Probably best to not use your real name on the BES server or the Blackberry, and somehow mask the real names of all of your contacts whenever and however possible (first name, first initial of last name works ok, right?). The alternative here is an iPhone 3GS using the CIS benchmark and the built-in iOS full-disk encryption, S/MIME for mail, don't use full real names, etc, but note that the GSM network is fairly insecure compared to say, the networks of Sprint or Verizon in the US. If you sync the iPhone with iTunes, be very careful to note that iTunes now contains the password to the iPhone.


How safe is NAT in keeping my private network private To extend on How can a webpage scan my local, internal network from the Internet? how safe is my private network against possible threats like DoS attacks, spoofing attacks, revealing info about my private network services etc. Have there have been recent exploits?

I recently read (https://www.sans.org/reading-room/whitepapers/networkdevs/easy-steps-cisco-extended-access-list-231) that without an ACL set incoming ICMP echo request (ICMP type 8), ICMP time-exceeded (ICMP type 11) could reveal your intranet structure. Is that true?

NAT as used in typical SoHo routers implicitly protects you from direct access from outside into your network. And that's about all it does.

Specifically it does not protect you against anything which is initiated from inside, like opening a mail or visiting some external web site. NAT will not protect against scanning the internal network if this scanning was initiated from inside - no matter if the script for scanning the local network was loaded when visiting an external web site. NAT will also not protect against loading some malware from outside which then can attack your network from inside or provide an attacker with a backdoor in your private network.

In other words: NAT does not help a lot in protecting the privacy of your network.

  I recently read ... that without an ACL set incoming ICMP echo request (ICMP type 8), ICMP time-exceeded (ICMP type 11) could reveal your intranet structure.

In case of NAT no access initiated from outside to the inside is possible and this includes ICMP. What you've read is not about NAT.


What wordlist does OWASP ZAP spider use? I am trying to figure out how OWASP ZAP discovered a directory on a practice vm, I entered the host IP and hit attack, and the spider discovered this directory (pChart2.3.1).

I have searched every wordlist used by dirbuster and none of them contain this string so dirbuster would not find it. I also tried using spider in Burp, but it came up blank. (The index page simply says "It Works" with nothing additional in the source.)
ZAP seems to have sent a request for robots.txt, then for sitemap.xml, and then struck the directory. The thing is, neither robots.txt or sitemap.xml exist.

My question in a nutshell is, does OWASP ZAP use a specific wordlist to search for directories, and if so, where is it. Alternatively, has it managed to get sitemap.xml even though the server says it doesn't exist?

I am taking a practical exam soon that doesn't allow the use of ZAP, and would like to be able to replicate its findings in another tool, or even just understand what it has done!

For  future reference:

ZAP works as spider. Spiders crawl through data and find connection points in nodes. Webspiders follow links, sources, anchors in HTML, JS and CSS. Every time a connection is found, it is added to the source tree, creating an hierarchical data structure knows as a searchtree. To give a simplified example:

\-root
  |-page
  |-page
  | |-css
  | \-js
  |   |-js
  |   |-font
  |   \-js
  |     \-img
  \-xhr
    |-js
    |-img
    |-doc
    | \-xml
    \-json
      \-html

At some point the tree is traversed, and ZAP requests each of these nodes individuality, allowing it to send additional form data, GET requests, headers and so on. These trees can become massive, which explains why ZAP takes a long time to complete. One can limit or expand the tree by suppyling a max depth or to include other (sub)domains.

The same technique is used by search engines to index webcontent.


Securing HSM's Login Keys I have an PKCS#11 enabled application which interacts with HSM to store TDES keys. The HSM is initialized with the Security Officer (SO) password provided by the user while the application was first installed.

I would like to know how best to preserve the SO password so that if the application/system were to restart, without human intervention application can use the SO password to open sessions with HSM and utilize it. Currently, I try to read of the password stored encrypted in the file system. The key to encryption is hard coded in application. This would prevent anyone getting access to key/password unless intrudes the memory while the application is run. Seeking human input on every application restart is also ruled out.

What do security procedures normally recommend for protecting passwords/keys which an application uses to access service from other applications (HSM in my case) ?

one way might be using a smartcard or similar for the authentication, nobody can read a password or similar from a smartcard and when you pull it, nobody is going to access your HSM, at least in theory.


Is the payload for DOM based XSS defined to originate from only inside the browser or even outside of it I have read in multiple places contradictory views on what might be considered a DOM based XSS. It seems that the original definition says that it is a form of XSS where the payload originates exclusively from inside the browser, but some people also view it as a form of XSS where the payload may not necessarily originate from inside the browser, but is used to modify the DOM.

The second view is what confuses me. What exactly does it mean that the payload is used to modify the DOM? The OWASP page describing DOM XSS , gives an example which, to me seems to be the same as reflected XSS.

It says:

  A DOM Based XSS attack against this page can be accomplished by sending the following URL to a victim:
  http://www.some.site/page.html?default=<script>alert(document.cookie)</script>. When the victim clicks on this link, the browser sends a request for: /page.html?default=<script>alert(document.cookie)</script>. The server responds with the page containing the above Javascript code.

  The original Javascript code simply echoes it into the page (DOM) at runtime. The browser then renders the resulting page and executes the attacker’s script: alert(document.cookie)

Since the payload is going from the victim's browser to the server and coming back to the browser, how is this not reflected XSS instead?

Should I interpret this as Reflected XSS means being able to injecting <script> tags in an HTML context, and DOM based XSS means being able to inject payload inside an already existing <script>?

DOM based XSS vs Reflected XSS

  Should I interpret this as Reflected XSS means being able to injecting <script> tags in an HTML context, and DOM based XSS means being able to inject payload inside an already existing <script>?

No.

Reflected XSS means that your injected payload is reflected into the answer delivered by the server and executed by the browser (it doesn't matter where the payload is inserted, as long as it is interpreted by the browser).

With DOM based XSS, the payload may or may not be delivered in the reply of the server, but it will not be executed by the browser as-is. Instead, the JavaScript code delivered by the server will take it, and insert it into the DOM, thus leading to its execution.

DOM based XSS and Server Interaction

  Since the payload is going from the victim's browser to the server and coming back to the browser, how is this not reflected XSS instead?

Because the fact that it goes to the server and back is not relevant for the attack.

What is relevant for the attack is that the JavaScript delivered by the server reads out the URL and inserts it into the DOM, thus executing the injected code.

If you keep reading, OWASP also describes this:

  The server responds with the page containing the above Javascript code. The browser creates a DOM object for the page, in which the document.location object contains the string:

http://www.some.site/page.html?default=<script>alert(document.cookie)</script>

  The original Javascript code in the page does not expect the default parameter to contain HTML markup, and as such it simply echoes it into the page (DOM) at runtime.
  [...]
  In the example above, while the payload was not embedded by the server in the HTTP response, it still arrived at the server as part of an HTTP request, and thus the attack could be detected at the server side.

So OWASP also specifically states that a DOM based attack can go to the server and back.


Does Two Factor Authentication (2FA) prevent Phishing and/or Man-in-the-Middle (MITM) attacks? While 2FA is clearly an improvement over only a single factor, is there anything which prevents an adversary presenting a convincing sign-in page which captures both factors?
I realise that technically a MITM attack is different to a Phishing attack, though at a high level they're very similar -- the user is inputting their credentials into an attacker-controlled page and the attacker can then input the credentials onwards into the real page.

It depends on the second factor. Most old-school ones (SMS, Google Authenticator, Email code) will not help.
In the case of U2F security keys, the protocol involves a challenge/response and a key pair. The website knows the public key and the security key knows how to generate the private key.
The private key is generated on the fly by the security key using a combination of its own secret (baked into the key) and some parameters. One of the parameters is the origin (in this case, the URI of the website issuing the challenge).
When I first register my key with www.mybank.com (my fancy bank that actually knows what security keys are. ha!) it generated a key pair derived from {private_security_key_data, www.mybank.com, <other parameters>} and gave the public key to the bank.
When I try to sign in later, my security key can solve the challenge because the key pair is generated from the same parameters. However, if I click on a phishing link (eg: www.myfakebank.com) the challenge cannot be completed since the generated key pair will be completely different.
The question now becomes: where does the URI come from? This is provided by the browser's U2F support. In turn, the browser verifies the URI through the standard certificates.
You can find details on this (and a lot more other security features) on Yubikey's overview of U2F.


How to properly use PGP for e-mail encryption/signature (key generation, key rollover, etc.) To improve my privacy, I would like to use PGP to encrypt/sign my e-mails.

How should I proceed to use PGP in a secure fashion?

I am trying to think about how to do it properly. From what I found, There is 2 main issues:

Key generation
Key rollover

For the key generation, it seems that using RSA/RSA with a keysize of 2048-bit is largely enough. I immediately generate a revoke certificate and store it somewhere safe (print it as a QR code).

Then I send my public key to the keyservers.

However, what seems the most obscur to me is how should I proceed when my PGP is about to expire. Should I just forgot about the old one and generate a new pair? Wouldn't that create a duplicate on the keyserver? Should I revoke my old key pair?

I couldn't find any good information about this; people seem to only focus on the key generation.

Note that I am not only interested in the key rollover, because I may miss an important issue (as I didn't know about keeping a revoke certificate before loosing my first key pair, ahem).

If I am missing an important point, do not hesitate to mention it.

A key that has expired does not need to be revoked. Generate a new key and sign it with the old one.

It shouldn't be a problem that there is more than one key under your name on the key servers. Remember, never trust a key based on the name/e-mail address in its uid! Anyone could put that there. Always check the fingerprint and/or trusted signatures on the key.


SambaCry CVE-2017-7494 returns "Exploit completed, but no session was created" I am using this exploit on msfconsole to exploit a VM with samba and the configuration is as follows:

Module options (exploit/linux/samba/sambacry)
Payload options (linux/x64/meterpreter/reverse_tcp)
2   Linux x86_64 -> target

the rhost, rport, lhost, and lport are also set.

I run the exploit on kali linux on an aws ec2 instance. Each VM is in a different subnetwork, but I can ping one another with their respective private ip addresses.

Both VMs have no firewalls (security groups desabled allowing all inbound and outbound traffic)

The samba version I am using is 4.3.11 for ubuntu 4.4.0-1066-aws

Does anyones know the reason for me still getting "Exploit completed, but no session was created." ?

Target might have some sort of antivirus. Also maybe you mistyped some of data like lport,lhost.


Hardware Dependent Encryption I am looking for a Linux based encryption system (like Truecrypt) that has the ability to do the following:

Encrypt a partition or external drive that it can only be read from the same computer where it was encrypted. If the partition or external drive is brought to another computer it will not read the drive. Basically it depends on the hardware.
If used on the same computer where it was encrypted it will load without asking for a password or anything else.

I have been reading the truecrypt manual but have not yet found an option or feature that shows me if this is possible.

We do not do product recommendations here, but what you are looking for is software that stores the key in the TPM.  The TPM does not necessarily require a password for the key to be used, but the key cannot be moved along with the drive to another computer.

You should be able to use LUKS with the key stored in the TPM (there is a project for that called tpm-luks: https://github.com/shpedoikal/tpm-luks).

I don't think there is a turnkey solution for this; I would expect it to require some effort on your part.


Encrypt and decrypt large files with RSA, is it possible? Encrypt and decrypt large files with RSA, is it possible?
I need to encrypt / decrypt files and save the private key named file encoder
I've seen it's not acceptable to work on large files with RSA
Is there a way to do this anyway?
and if not
How to connect AES to RSA and save minimum keys (I can not save the keys in a separate file)

RSA is way too low level for users and most application programmers, never implement an encryption scheme using RSA yourself. There are way too many pitfalls that will render your encryption to become useless when using plain RSA.

Instead, just use something like GnuPG (which uses OpenPGP format):

gpg --output encrypted.gpg --encrypt --recipient avigaga plain.txt

and to decrypt:

gpg --output plain2.txt --decrypt encrypted.gpg

There are also GUI tools for all major operating systems if you do this often and if that's your preference.

OpenPGP uses RSA and AES, but it has combined them in a secure way, so you don't have to combine them yourself, and so you avoid the pitfalls of trying to combine them in insecure ways.


Trying to keep high school students out of the Wi-Fi network I'm a teacher and IT person at a small K-12 school.

The students are not supposed to have phones, laptops or access to the network. However, students being students they will try to find a way around the rules.

The students manage to acquire the Wi-Fi passwords pretty much as soon as we change them. It becomes a game to them. Although they are not supposed to, they will bring their laptops and phones in and use the network. One of them will get the password, and it travels like wildfire throughout the school. It is sometimes as simple as writing it on a wall where the rest of the students can get the updated password.

What can we do to keep them out of the network? I'm considering entering MAC addresses, but that's very labourious, and still not a guarantee of success if they spoof the address.

Do any of you have any suggestions?

Some background:

There are four routers in a 50-year-old building (plenty of concrete walls). One router downstairs, and three upstairs. They are different brands and models (Netgear, Asus, Acer, D-Link) so no central administration.

The school has about 30 Chromebooks and a similar number of iPads. Teachers will use their own laptops (a mix of Windows Vista, Windows 7, and Windows 8 as well as a number of Mac OS X).

Some of the teachers are not at all comfortable with technology and will leave the room with their machines accessible to the students. The teachers will often leave their password off or even give it to the students when they need help. They will ask for help from the students when setting up a projector for example and leave them to it, there goes the security once again. No sooner that the teacher is out of the room than they'll go to the taskbar and look at the properties of the Wi-Fi router to get the password.

Enforce Consequences for Students Found on the Network

The first thing you need to do is ensure you have a written policy outlining what devices are allowed on the network. However, if you are not consistent in the enforcement of your policy, it is useless.

This should also cover the usage policies for the Teachers, including locking their computers when they are not present at the machine. You can also use Group Policy to prevent users from being able to view the WiFi password.

Technical Measures

The following consists of various options for limiting the use of student devices on the school network. The most effective is WPA2-Enterprise. The others are included because they may be effective enough in limiting unauthorized access by students and, depending on you particular network, may be easier to implement.

However, the question suggests that the students are on the main network for the organization. Only WPA2-Enterprise is going to adequately protect your network from an attack of an unauthorized device. Once a PSK is known, a student has the ability to sniff teacher web traffic, and possibly capture email and windows hashes. Additionally, a malicious user could start attacking other machines directly.

WPA2-Enterprise

The best solution would be to implement WPA2-Enterprise, instead of using a pre shared key (WPA2-PSK). This allows individual credentials to be issued. This is implemented by installing client certificates on each machine. This requires a good bit of engineering and is not trivial to set up in larger environments. This page has some good pointers on how to deploy WPA2-Enterprise.

Captive Portal

As @Steve Sether mentioned, the Chillispot captive portal can be used to authenticate users once they have connected to the network. Although I don't have evidence to point to, I suspect such a portal can be bypassed by spoofing MAC and IP addresses. However, it does raise the difficulty and will be easier to manage than MAC Filtering on multiple devices.

MAC Address Filtering

As you mentioned, MAC addresses can be spoofed, so the effectiveness of MAC address filtering is limited. However, many phones prevent spoofing the MAC address, so this will address some of the problematic users. The iPhone for instance, needs to be jailbroken before the MAC address can be changed. The hardest part of using MAC address filtering is going to be managing the list of allowed MAC addresses especially across multiple devices from various vendors.

I would also argue that there is 'legal' benefit of using MAC Address Filtering or a Captive Portal. It can be hard to claim a user was unauthorized to access a network when the password is written on a whiteboard. However, if a user has to explicitly bypass a security restriction, you have a stronger case against the activity.

Using an Internet Proxy to Prevent Unauthorized Uses of HTTPS

Implement a HTTPS solution that uses your own private key. You can install the corresponding certificate to the organization's machines and they won't notice anything different (though the organization should still tell the staff that HTTPS interception is occurring). However, unauthorized devices without the certificate will get a nasty message about HTTPS being invalid whenever they try to browse a secure page. Additionally, since you are decrypting the HTTPS traffic, you will be able to monitor the traffic. For instance, seeing which students log into Facebook will allow you to address those students directly.

Many Content Control implementations offer the ability to decrypt HTTPS traffic. If the school already has a Content Control mechanism in place (such as Bluecoat or Net Nanny), talk to your vendor about how to implement this feature.


HTTPS and error code 503 I tried to visit a HTTPS page and server responded with 503 response - currently unavailable. In address bar, there was an address of that Facebook page, but it was not HTTPS but HTTP, probably because of server overload. I know that it is very unusual, but it happened. I want to know if my visit to that page is recorded by ISP or not. I'm also using Google open DNS.

Yes, your ISP has records of your attempt to visit the original page.  That request left your browser, went through the ISP and to Facebook, which sent back a response of a 503 error, which your ISP also has records of.


Recognizing PGP-encrypted disks I am studying various disk encryption schemes (such as PGP, MS Bit Locker, BestCrypt and TrueCrypt) on my Windows OS.

I am interested to know how an encrypted partition/disk/file with a particular scheme (e.g. PGP) can be distinguished from other disk encryption schemes.

While studying I found that there is an inherent challenge: how to determine if an encrypted disk or volume exists. I found one free tool, EDD (Encrypted Disk detector) which does recognize disks and volumes encrypted by PGP, TrueCrypt, BitLocker. EDD relies on signature-based detection and hence recognizes the above encryption schemes. I want to know how EDD performs signature-based detection concretely (say for eg PGP). More generally, how can I detect whether disks or volumes are PGP-encrypted or not?

If the encryption software stores meta-data or other (unencrypted) signatures/magic-numbers, or verifiable structures, then these can be used for identification of course — but, since this gives the game away in a sense, you'll find that the better ones explicitly do not, e.g. from the Truecrypt volume format specification:

  TrueCrypt volumes have no "signature" or ID strings. Until decrypted, they appear to consist solely of random data.

A TrueCrypt feature is plausible deniability, the intent being to make it impossible to prove the existence of an encrypted volume (or at least makes one's deniability of its existence believable).

I believe EDD relies on signatures for those formats which have identifiable signatures; heuristics, e.g. the presence of non-zero sectors outside a filesystem partition; and more recently named process/driver detection for those lacking signatures. This PDF paper covers some of the known signatures at the time (2005), including PGP (v9). This paper (PDF) is a more recent forensic analysis of OS X FileVault 2, which is interesting reading.

For practical purposes with software-only disk encryption implementations there may be unencrypted, easily identifiable code on the disk, e.g. in the case full-disk encryption with a boot-time password/key prompt. Identifying the bootstrap code may trivially identify the product.

Accurately identifying pseudo-random data is an impossible problem (though at least with encrypted disk volumes you should have a sufficiently large amount of data to make some statistical assertions about the randomness).
A robust encryption algorithm should have an output indistinguishable from random (regardless of identifying metadata in the actual output format), this is what TrueCrypt's plausible deniability relies on.

For performance reasons, disk encryption may not be as cryptographically secure as possible, e.g. there may be limited or no MAC (integrity/anti-tampering), and the encryption mode will localise and limit the required on-disk sectors to be updated (see this Wikipedia page on XTS as used by TrueCrypt for possible problems). These can be leveraged in an active method of attack, e.g. if you can convince someone to store a crafted file (see Water-marking attacks). I'm not aware of any methods which can use these limitations to attack or identify disk encryption (cold-boot attacks seem to be the preferred method, or at least get more attention).

Update:  (Oct. 2013) while reading about the upcoming TrueCrypt open audit project (and here) I found this document:
  Security Analysis of TrueCrypt 7.0a (PDF) from August 2011.


Use password_hash() with a system-wide salt and a user-specific salt This is somewhat a followup to "About password_hash() in PHP and storing (part of) its salt outside DB".

Is there a way or any advantage to have a system-wide salt and a user-specific salt vs just a user specific salt? If so, how can I archieve that with that function? Is there a way to replace its internal salt generator with something as secure or more secure than it and then only store the user portion of the salt in the user table?

If the system salt is used, it will be stored in a different place in a specific server.

That's called a "keyed hash" and the key is sometimes called "pepper."

Yes, there is a security advantage.  If the key is not stored in a database but is, perhaps, a constant in a program, then a database leak through SQL injection or similar will not reveal the key and your data will be nearly crack-proof.

Of course, if the OS gets owned, it sort-of doesn't make any difference what you've done.  However, it at least appears that many password leaks are due to SQL injection attacks.

There is an extremely useful essay on password hashing here: https://crackstation.net/hashing-security.htm  It has a section on keyed hashes.  That essay recommends against hard-coding the key, and that's right if you're going to install a program in a number of places.  For a one-off installation, I still think it's OK.  Just be sure that the key is generated using a cryptographically secure random number generator (CSPRNG) in any case.